CVE-2014-8095

2014-12-0900:00:00

ubuntu.com

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.013 Low

EPSS

Percentile

85.9%

JSON

The XInput extension in X.Org X Window System (aka X11 or X) X11R4 and
X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote
authenticated users to cause a denial of service (out-of-bounds read or
write) or possibly execute arbitrary code via a crafted length or index
value to the (1) SProcXChangeDeviceControl, (2) ProcXChangeDeviceControl,
(3) ProcXChangeFeedbackControl, (4) ProcXSendExtensionEvent, (5)
SProcXIAllowEvents, (6) SProcXIChangeCursor, (7) ProcXIChangeHierarchy, (8)
SProcXIGetClientPointer, (9) SProcXIGrabDevice, (10) SProcXIUngrabDevice,
(11) ProcXIUngrabDevice, (12) SProcXIPassiveGrabDevice, (13)
ProcXIPassiveGrabDevice, (14) SProcXIPassiveUngrabDevice, (15)
ProcXIPassiveUngrabDevice, (16) SProcXListDeviceProperties, (17)
SProcXDeleteDeviceProperty, (18) SProcXIListProperties, (19)
SProcXIDeleteProperty, (20) SProcXIGetProperty, (21) SProcXIQueryDevice,
(22) SProcXIQueryPointer, (23) SProcXISelectEvents, (24)
SProcXISetClientPointer, (25) SProcXISetFocus, (26) SProcXIGetFocus, or
(27) SProcXIWarpPointer function.

OSVersionArchitecturePackageVersionFilename
ubuntu12.04noarchxorg-server< 2:1.11.4-0ubuntu10.15UNKNOWN
ubuntu14.04noarchxorg-server< 2:1.15.1-0ubuntu2.4UNKNOWN
ubuntu14.10noarchxorg-server< 2:1.16.0-1ubuntu1.1UNKNOWN
ubuntu12.04noarchxorg-server-lts-trusty< 2:1.15.1-0ubuntu2~precise3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	12.04	noarch	xorg-server	< 2:1.11.4-0ubuntu10.15	UNKNOWN
ubuntu	14.04	noarch	xorg-server	< 2:1.15.1-0ubuntu2.4	UNKNOWN
ubuntu	14.10	noarch	xorg-server	< 2:1.16.0-1ubuntu1.1	UNKNOWN
ubuntu	12.04	noarch	xorg-server-lts-trusty	< 2:1.15.1-0ubuntu2~precise3	UNKNOWN