Vulnerabilities > CVE-2013-1991 - Numeric Errors vulnerability in X Libxxf86Dga
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Multiple integer overflows in X.org libXxf86dga 1.1.3 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XDGAQueryModes and (2) XDGASetMode functions.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 8 |
Common Weakness Enumeration (CWE)
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_11_XORG-X11-DEVEL-130612.NASL description This update of xorg-x11-libs fixes several integer and buffer overflow issues. (bnc#815451, bnc#821663) last seen 2020-06-05 modified 2013-06-29 plugin id 67106 published 2013-06-29 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/67106 title SuSE 11.2 Security Update : xorg-x11-libs (SAT Patch Number 7846) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1869-1.NASL description Ilja van Sprundel discovered multiple security issues in various X.org libraries and components. An attacker could use these issues to cause applications to crash, resulting in a denial of service, or possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 66833 published 2013-06-06 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66833 title Ubuntu 12.04 LTS / 12.10 / 13.04 : libxxf86dga vulnerabilities (USN-1869-1) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_2EEBEBFFCD3B11E28F09001B38C3836C.NASL description freedesktop.org reports : Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org last seen 2020-06-01 modified 2020-06-02 plugin id 66798 published 2013-06-05 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66798 title FreeBSD : xorg -- protocol handling issues in X Window System client libraries (2eebebff-cd3b-11e2-8f09-001b38c3836c) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2014-1436.NASL description Updated X11 client libraries packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The X11 (Xorg) libraries provide library routines that are used within all X Window applications. Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol data to an X11 server via a malicious X11 client could use either of these flaws to potentially escalate their privileges on the system. (CVE-2013-1981, CVE-2013-1982, CVE-2013-1983, CVE-2013-1984, CVE-2013-1985, CVE-2013-1986, CVE-2013-1987, CVE-2013-1988, CVE-2013-1989, CVE-2013-1990, CVE-2013-1991, CVE-2013-2003, CVE-2013-2062, CVE-2013-2064) Multiple array index errors, leading to heap-based buffer out-of-bounds write flaws, were found in the way various X11 client libraries handled data returned from an X11 server. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client. (CVE-2013-1997, CVE-2013-1998, CVE-2013-1999, CVE-2013-2000, CVE-2013-2001, CVE-2013-2002, CVE-2013-2066) A buffer overflow flaw was found in the way the XListInputDevices() function of X.Org X11 last seen 2020-06-01 modified 2020-06-02 plugin id 79182 published 2014-11-12 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79182 title CentOS 6 : libX11 / libXcursor / libXext / libXfixes / libXi / libXinerama / libXp / libXrandr / etc (CESA-2014:1436) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2014-1436.NASL description Updated X11 client libraries packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The X11 (Xorg) libraries provide library routines that are used within all X Window applications. Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol data to an X11 server via a malicious X11 client could use either of these flaws to potentially escalate their privileges on the system. (CVE-2013-1981, CVE-2013-1982, CVE-2013-1983, CVE-2013-1984, CVE-2013-1985, CVE-2013-1986, CVE-2013-1987, CVE-2013-1988, CVE-2013-1989, CVE-2013-1990, CVE-2013-1991, CVE-2013-2003, CVE-2013-2062, CVE-2013-2064) Multiple array index errors, leading to heap-based buffer out-of-bounds write flaws, were found in the way various X11 client libraries handled data returned from an X11 server. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client. (CVE-2013-1997, CVE-2013-1998, CVE-2013-1999, CVE-2013-2000, CVE-2013-2001, CVE-2013-2002, CVE-2013-2066) A buffer overflow flaw was found in the way the XListInputDevices() function of X.Org X11 last seen 2020-06-01 modified 2020-06-02 plugin id 78411 published 2014-10-14 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78411 title RHEL 6 : X11 client libraries (RHSA-2014:1436) NASL family SuSE Local Security Checks NASL id SUSE_11_XORG-X11-DEVEL-130625.NASL description This update of xorg-x11-libs fixes several integer and buffer overflow issues. Bug 815451/821663 CVE-2013-1984 / CVE-2013-1985 / CVE-2013-1986 / CVE-2013-1988 / CVE-2013-1990 / CVE-2013-1991 / CVE-2013-1992 / CVE-2013-1995 / CVE-2013-1996 / CVE-2013-1998 / CVE-2013-1999 / CVE-2013-2000 / CVE-2013-2001 / CVE-2013-2003 / CVE-2013-2063 last seen 2020-06-05 modified 2013-07-30 plugin id 69112 published 2013-07-30 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69112 title SuSE 11.3 Security Update : xorg-x11-libs (SAT Patch Number 7944) NASL family Fedora Local Security Checks NASL id FEDORA_2013-9177.NASL description update to fix CVE-2013-1991 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-07-12 plugin id 67356 published 2013-07-12 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/67356 title Fedora 18 : libXxf86dga-1.1.3-5.20130524gita8dc6be32.fc18 (2013-9177) NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2014-452.NASL description Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol data to an X11 server via a malicious X11 client could use either of these flaws to potentially escalate their privileges on the system. (CVE-2013-1981 , CVE-2013-1982 , CVE-2013-1983 , CVE-2013-1984 , CVE-2013-1985 , CVE-2013-1986 , CVE-2013-1987 , CVE-2013-1988 , CVE-2013-1989 , CVE-2013-1990 , CVE-2013-1991 , CVE-2013-2003 , CVE-2013-2062 , CVE-2013-2064) Multiple array index errors, leading to heap-based buffer out-of-bounds write flaws, were found in the way various X11 client libraries handled data returned from an X11 server. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client. (CVE-2013-1997 , CVE-2013-1998 , CVE-2013-1999 , CVE-2013-2000 , CVE-2013-2001 , CVE-2013-2002 , CVE-2013-2066) A buffer overflow flaw was found in the way the XListInputDevices() function of X.Org X11 last seen 2020-06-01 modified 2020-06-02 plugin id 79560 published 2014-11-26 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79560 title Amazon Linux AMI : libX11 / libXcursor,libXfixes,libXi,libXrandr,libXrender,libXres,libXt,libXv,libXvMC,libXxf86dga,libXxf86vm,libdmx,xorg-x11-proto-devel (ALAS-2014-452) NASL family SuSE Local Security Checks NASL id SUSE_XORG-X11-8623.NASL description This update of xorg-x11 fixes several security vulnerabilities. - Bug 815451- X.Org Security Advisory: May 23, 2013 - Bug 821664 - libX11 - Bug 821671 - libXv - Bug 821670 - libXt - Bug 821669 - libXrender - Bug 821668 - libXp - Bug 821667 - libXfixes - Bug 821665 - libXext - Bug 821663 - libFS, libXcursor, libXi, libXinerama, libXRes, libXtst, libXvMC, libXxf86dga, libXxf86vm, libdmx last seen 2020-06-05 modified 2013-07-12 plugin id 67256 published 2013-07-12 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67256 title SuSE 10 Security Update : xorg-x11 (ZYPP Patch Number 8623) NASL family Fedora Local Security Checks NASL id FEDORA_2013-9085.NASL description update for CVE-2013-2000 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-05-28 plugin id 66628 published 2013-05-28 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/66628 title Fedora 19 : libXxf86dga-1.1.3-5.20130524gita8dc6be32.fc19 (2013-9085) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2690.NASL description Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to privilege escalation or denial of service. last seen 2020-03-17 modified 2013-05-24 plugin id 66574 published 2013-05-24 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66574 title Debian DSA-2690-1 : libxxf86dga - several vulnerabilities NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-509.NASL description This update of libXxf86dga fixes several buffer and integer overflow issues. - U_0001-integer-overflow-in-XDGAQueryModes-CVE-2013-1991- 1-2.patch, U_0002-integer-overflow-underflow-in-XDGASetMode-CVE-201 3-1.patch - integer overflow in XDGAQueryModes(); integer overflow & underflow in XDGASetMode() [CVE-2013-1991] (bnc#821663, bnc#815451) - U_0001-buffer-overflow-in-XDGAQueryModes-CVE-2013-2000-1 -2.patch, U_0002-buffer-overflow-in-XDGASetMode-CVE-2013-2000-2-2. patch - buffer overflow in XDGAQueryModes(), XDGASetMode() [CVE-2013-2000] (bnc#821663, bnc#815451) last seen 2020-06-05 modified 2014-06-13 plugin id 75045 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75045 title openSUSE Security Update : libXxf86dga (openSUSE-SU-2013:1030-1) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201405-07.NASL description The remote host is affected by the vulnerability described in GLSA-201405-07 (X.Org X Server: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in X.Org X Server. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or obtain sensitive information. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 74028 published 2014-05-16 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/74028 title GLSA-201405-07 : X.Org X Server: Multiple vulnerabilities NASL family Scientific Linux Local Security Checks NASL id SL_20141014_X11_CLIENT_LIBRARIES_ON_SL6_X.NASL description Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol data to an X11 server via a malicious X11 client could use either of these flaws to potentially escalate their privileges on the system. (CVE-2013-1981, CVE-2013-1982, CVE-2013-1983, CVE-2013-1984, CVE-2013-1985, CVE-2013-1986, CVE-2013-1987, CVE-2013-1988, CVE-2013-1989, CVE-2013-1990, CVE-2013-1991, CVE-2013-2003, CVE-2013-2062, CVE-2013-2064) Multiple array index errors, leading to heap-based buffer out-of-bounds write flaws, were found in the way various X11 client libraries handled data returned from an X11 server. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client. (CVE-2013-1997, CVE-2013-1998, CVE-2013-1999, CVE-2013-2000, CVE-2013-2001, CVE-2013-2002, CVE-2013-2066) A buffer overflow flaw was found in the way the XListInputDevices() function of X.Org X11 last seen 2020-03-18 modified 2014-11-04 plugin id 78841 published 2014-11-04 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78841 title Scientific Linux Security Update : X11 client libraries on SL6.x i386/x86_64 (20141014)
Redhat
| rpms |
|