X.Org X Server Local Security Bypass Vulnerability

X.Org X Server is an X Window System display server from the X.Org Foundation. A local security bypass vulnerability exists in X.Org X Server. An attacker could use this vulnerability to bypass certain security restrictions and perform unauthorized operations...

Apple OS X Server Denial of Service And RCE Vulnerabilities (HT208102)

Apple OS X Server is prone to denial of service DoS and remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Tor Linux Sandbox Breakout Via X11

Tor: Linux sandbox breakout via X11 From inside the Linux sandbox described in https://blog.torproject.org/blog/tor-browser-70-released, it is still possible to talk to the X server without any restrictions. This means that a compromised browser can e.g. use the XTEST X protocol extension at...

BSA-2017-374

Security Advisory ID : BSA-2017-374 Component : Linux Kernel Revision : 2.0: Interim The doanonymouspage function in mm/memory.c in the Linux kernel before 2.6.27.52, 2.6.32.x before 2.6.32.19, 2.6.34.x before 2.6.34.4, and 2.6.35.x before 2.6.35.2 does not properly separate the stack and the hea...

LXDM Security Bypass Vulnerability

LXDM is a lightweight display manager product for the LXDE desktop environment. A security vulnerability exists in versions of LXDM prior to 0.5.2 that stems from the program failing to start the X server with the '-auth' parameter. A local attacker can exploit this vulnerability to bypass...

UBUNTU-CVE-2015-8308

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

DEBIAN-CVE-2015-8308

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

Authentication flaw

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

CVE-2015-8308

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

CVE-2015-8308

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

CVE-2015-8308

LXDM (Lightweight Display Manager for LXDE) before 0.5.2 fails to start the X server with the -auth parameter, allowing a local user to bypass authentication via X connections. The concrete affected version is LXDM

CVE-2015-8308

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

CVE-2015-8308

LXDM before 0.5.2 did not start X server with -auth, which allows local users to bypass authentication with X connections...

MGASA-2017-0269 Updated x11-server packages fix security vulnerabilities

Eric Sesterhenn discovered that the X.Org X server incorrectly compared MIT cookies. An attacker could possibly use this issue to perform a timing attack and recover the MIT cookie CVE-2017-2624. It was discovered that the X.Org X server incorrectly handled endianness conversion of certain X...

tigervnc: Double free via crafted fences

A double free flaw was found in the way TigerVNC handled ClientFence messages. A remote, authenticated attacker could use this flaw to make Xvnc crash by sending specially crafted ClientFence messages, resulting in denial of service...

Ubuntu 14.04 LTS / 16.04 LTS : X.Org X server vulnerabilities (USN-3362-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3362-1 advisory. It was discovered that the X.Org X server incorrectly handled endianness conversion of certain X events. An attacker able to connect to an X...

Ubuntu: Security Advisory (USN-3362-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-3362-1: X.Org X server vulnerabilities

It was discovered that the X.Org X server incorrectly handled endianness conversion of certain X events. An attacker able to connect to an X server, either locally or remotely, could use this issue to crash the server, or possibly execute arbitrary code as an administrator. CVE-2017-10971 It was...

CVE-2017-10971

In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events...

CVE-2017-10972

Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server...