USN-2500-1: X.Org X server vulnerabilities

Olivier Fourdan discovered that the X.Org X server incorrectly handled XkbSetGeometry requests resulting in an information leak. An attacker able to connect to an X server, either locally or remotely, could use this issue to possibly obtain sensitive information. CVE-2015-0255 It was discovered...

FreeBSD : xorg-server -- Information leak in the XkbSetGeometry request of X servers. (54a69cf7-b2ef-11e4-b1f1-bcaec565249c)

Peter Hutterer reports : Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request. The issue stems from the server trusting the client to send valid string lengths in the request data. A malicious client with string...

Debian Security Advisory DSA 3160-1 (xorg-server - security update)

Olivier Fourdan discovered that missing input validation in the Xserver OpenVAS Vulnerability Test $Id: deb3160.nasl 6609 2017-07-07 12:05:59Z cfischer $ Auto-generated from advisory DSA 3160-1 using nvtgen 1.0 Script version: 1.0 Author: Greenbone Networks Copyright: Copyright c 2015 Greenbone...

xorg-server -- Information leak in the XkbSetGeometry request of X servers.

Peter Hutterer reports: Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request. The issue stems from the server trusting the client to send valid string lengths in the request data. A malicious client with string...

xorg-server: information leak and denial of service

Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request. The issue stems from the server trusting the client to send valid string lengths in the request data. A malicious client with string lengths exceeding the...

Mac-OS-X-Server-DirectoryService-Buffer-Overflow

The bug is located in the function 'DSTCPEndpoint::AllocFromProxyStruct' from 'DSTCPEndpoint.cpp'1. An attacker can control both the value of 'inProxyDataMsg-fDataSize' and the data that will be copied. Thus, by sending a huge amount of data and a small buffer size, the service will crash trying ...

CVE-2015-1308

kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked...

CVE-2015-1308

kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked...

Input validation

kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked...

CVE-2015-1308

CVE-2015-1308 affects kde-workspace 4.2.0 and plasma-workspace prior to 5.1.95. Affects KDE desktop components that manage the X server session; the underlying issue allows remote attackers with access to the X server while the screen is locked to observe input events and thereby obtain passwords...

CVE-2015-1308

kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote attackers to obtain input events, and consequently obtain passwords, by leveraging access to the X server when the screen is locked...

Updated nvidia packages fix security vulnerabilities

Updated nvidia304 and nvidia-current drivers fixes security issues: The NVIDIA Linux Discrete GPU drivers before R304.125, R331.x before R331.113, R340.x before R340.65, R343.x before R343.36, and R346.x before R346.22, Linux for Tegra L4T driver before R21.2, and Chrome OS driver before R40 allo...

Mac OS X Safari Archive Metadata Command Execution - Ver2 (CVE-2006-0397)

A command execution vulnerability has been reported in Apple Mac OS X and Apple Mac OS X Server. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

DLA-120-1 xorg-server - security update

Bulletin has no description...

MGASA-2014-0532 Updated x11-server packages fix security vulnerabilities

Ilja van Sprundel of IOActive discovered several security issues in the X.org X server, which may lead to privilege escalation or denial of service CVE-2014-8091, CVE-2014-8092, CVE-2014-8093, CVE-2014-8094, CVE-2014-8095, CVE-2014-8096, CVE-2014-8097, CVE-2014-8098, CVE-2014-8099, CVE-2014-8100,...

[SECURITY] Fedora 21 Update: xorg-x11-server-1.16.2.901-1.fc21

X.Org X11 X server...

FreeBSD : xserver -- multiple issue with X client request handling (27b9b2f0-8081-11e4-b4ca-bcaec565249c)

Alan Coopersmith reports : Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way the X server code base handles requests from X clients, and has worked with X.Org's security team to analyze, confirm, and fix these issues. The vulnerabilities...

Ubuntu 14.04 LTS : NVIDIA graphics drivers vulnerabilities (USN-2438-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2438-1 advisory. It was discovered that the NVIDIA graphics drivers incorrectly handled GLX indirect rendering support. An attacker able to connect to an X server, either...

nvidia: arbitrary code execution

It was discovered that the NVIDIA graphics drivers incorrectly handled GLX indirect rendering support. An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible privilege escalation...

nvidia-340xx: arbitrary code execution

It was discovered that the NVIDIA graphics drivers incorrectly handled GLX indirect rendering support. An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible privilege escalation...