X.Org LibX11 XKEYBOARD扩展本地溢出漏洞

X.Org是X.Org Foundation对X窗口系统的开源实现。 X11R6 X窗口系统库的字符控制函数中存在缓冲区溢出漏洞，远程攻击者可能利用此漏洞在服务器上执行任意指令。 如果将XKBCHARSET环境变量设置为很长的字符串并将DISPLAY环境变量设置为启用了XKEYBOARD扩展的X窗口系统服务器的话，则调用动态连接库时就会触发这个漏洞，导致执行任意指令。 X11R6.4中有漏洞的函数： static int if NeedFunctionPrototypes Strcmpchar str1, char str2 else Strcmpstr1, str2 char str1...

CVE-2006-5397

The Xinput module modules/im/ximcp/imLcIm.c in X.Org libX11 1.0.2 and 1.0.3 opens a file for reading twice using the same file descriptor, which causes a file descriptor leak that allows local users to read files specified by the XCOMPOSEFILE environment variable via the duplicate file descriptor...

CVE-2006-5397

The Xinput module modules/im/ximcp/imLcIm.c in X.Org libX11 1.0.2 and 1.0.3 opens a file for reading twice using the same file descriptor, which causes a file descriptor leak that allows local users to read files specified by the XCOMPOSEFILE environment variable via the duplicate file descriptor...

CVE-2006-5397

The CVE-2006-5397 issue affects X.Org libX11 1.0.2 and 1.0.3, specifically the Xinput module (modules/im/ximcp/imLcIm.c). The root cause is that the code opens a file for reading twice using the same file descriptor, causing a file descriptor leak. This leak allows local users to read files speci...

CVE-2006-5397

The Xinput module modules/im/ximcp/imLcIm.c in X.Org libX11 1.0.2 and 1.0.3 opens a file for reading twice using the same file descriptor, which causes a file descriptor leak that allows local users to read files specified by the XCOMPOSEFILE environment variable via the duplicate file descriptor...

CVE-2006-5397

The Xinput module modules/im/ximcp/imLcIm.c in X.Org libX11 1.0.2 and 1.0.3 opens a file for reading twice using the same file descriptor, which causes a file descriptor leak that allows local users to read files specified by the XCOMPOSEFILE environment variable via the duplicate file descriptor...

CVE-2006-4447

X.Org and XFree86, including libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm, does not check the return values for setuid and seteuid calls when attempting to drop privileges, which might allow local users to gain privileges by causing those calls to fail, such as by exceeding a ulimit...

CVE-2006-4447

Summary: CVE-2006-4447 affects X.Org and XFree86 components (libX11, xdm, xf86dga, xinit, xload, xtrans, xterm) where setuid/seteuid return values are not checked when dropping privileges. This may enable local privilege escalation if those calls fail (e.g., due to ulimit). What is affected: X.Or...

CVE-2002-1472

CVE-2002-1472 describes an untrusted search path vulnerability in XFree86’s libX11.so used by setuid/setgid programs. A local attacker can leverage a modified LD_PRELOAD to point to a malicious module and gain root privileges; impact is local privilege escalation. The vulnerability is associated ...

CVE-2002-1472

Untrusted search path vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LDPRELOAD environment variable that points to a malicious module...

SUSE-SA:2002:032: xf86

The remote host is missing the patch for the advisory SUSE-SA:2002:032 xf86. The xf86 package contains various libraries and programs which are fundamental for the X server to function. The libX11.so library from this package dynamically loads other libraries where the pathname is controlled by t...

CVE-2002-1472

Untrusted search path vulnerability in libX11.so in xfree86, when used in setuid or setgid programs, allows local users to gain root privileges via a modified LDPRELOAD environment variable that points to a malicious module...

Buffer overflow in libX11 for OpenUnix

Buffer overflow during -xrm command string argument parsing...

Security Update: [CSSA-2002-SCO.15] Open UNIX 8.0.0 UnixWare 7.1.1 : Buffer overflow in libX11 with -xrm

To: [email protected] [email protected] [email protected] Caldera International, Inc. Security Advisory Subject: Open UNIX 8.0.0 UnixWare 7.1.1 : Buffer overflow in libX11 with -xrm Advisory number: CSSA-2002-SCO.15 Issue date: 2002 April 11 Cross reference: 1. Problem...

CVE-2000-0620

The vulnerability CVE-2000-0620 affects the libX11 X library. A resource mask of 0 can cause the library to enter an infinite loop, enabling remote denial of service. The description indicates a network-exposed condition with a potential impact to availability, but the documents do not provide a ...

CVE-2000-0620

libX11 X library allows remote attackers to cause a denial of service via a resource mask of 0, which causes libX11 to go into an infinite loop...

XFree86: Various nasty libX11 holes

Hi, I'll summarize the impact and recommendations before I paste a mail which goes into technical details of the flaws. SUMMARY ======= Various coding flaws exist in libX11. Whilst this may not sound too serious, it is, for two reasons. They are 1 Various X client programs foolishly have privileg...

CVE-2000-0620

libX11 X library allows remote attackers to cause a denial of service via a resource mask of 0, which causes libX11 to go into an infinite loop...

X 11.03.3.33.3.43.3.53.3.64.0 - libX11 _XAsyncReply() Stack Corruption

X 11.03.3.33.3.43.3.53.3.64.0 - libX11 XAsyncReply Stack Corruption // source: https://www.securityfocus.com/bid/1408/info A vulnerability exists in the XAsyncReply function of libX11. This function utilizes size information retrieved as part of a client supplied packet. This value is a signed...

X 11.0/3.3.3/3.3.4/3.3.5/3.3.6/4.0 - libX11 '_XAsyncReply()' Stack Corruption

// source: https://www.securityfocus.com/bid/1408/info A vulnerability exists in the XAsyncReply function of libX11. This function utilizes size information retrieved as part of a client supplied packet. This value is a signed integer. By forcing this value to be negative, it becomes possible to...