Buffer Over-read

2024-04-1102:44:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

x.org server

buffer over-read

vulnerability

6.9 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

16.7%

JSON

X.org Server is vulnerable to Buffer Over-read. The vulnerability is due to the ProcXIGetSelectedEvents() function, where byte-swapped length values in replies can lead to memory leakage and segmentation faults. This issue, particularly when triggered by a client with a different endianness, could allow an attacker to cause the X server to read heap memory values and transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker’s inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.

CPENameOperatorVersion
xorg-server:edgeeq1.20.12-r0
xorg-server:edgeeq21.1.4-r1
xorg-server:edgeeq1.20.10-r4
xorg-server:edgeeq21.1.7-r2
xorg-server:edgeeq21.1.6-r1
xorg-server:edgeeq1.20.11-r0
xorg-server:edgeeq21.1.4-r0
xorg-server:edgeeq21.1.3-r0
xorg-server:edgeeq21.1.8-r0
xorg-server:edgeeq21.1.6-r0

Name	Operator	Version
xorg-server:edge	eq	1.20.12-r0
xorg-server:edge	eq	21.1.4-r1
xorg-server:edge	eq	1.20.10-r4
xorg-server:edge	eq	21.1.7-r2
xorg-server:edge	eq	21.1.6-r1
xorg-server:edge	eq	1.20.11-r0
xorg-server:edge	eq	21.1.4-r0
xorg-server:edge	eq	21.1.3-r0
xorg-server:edge	eq	21.1.8-r0
xorg-server:edge	eq	21.1.6-r0