Vulnerabilities > CVE-2013-1999 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in X Libxvmc
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Buffer overflow in X.org libXvMC 1.0.7 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the XvMCGetDRInfo function.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 6 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family Fedora Local Security Checks NASL id FEDORA_2013-12593.NASL description Update to 1.0.8, fixes potential strncpy overflow Update to latest git to fix the following CVEs: CVE-2013-1999 CVE-2013-1990 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-07-19 plugin id 68972 published 2013-07-19 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/68972 title Fedora 19 : libXvMC-1.0.8-1.fc19 (2013-12593) NASL family SuSE Local Security Checks NASL id SUSE_11_XORG-X11-DEVEL-130612.NASL description This update of xorg-x11-libs fixes several integer and buffer overflow issues. (bnc#815451, bnc#821663) last seen 2020-06-05 modified 2013-06-29 plugin id 67106 published 2013-06-29 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/67106 title SuSE 11.2 Security Update : xorg-x11-libs (SAT Patch Number 7846) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_2EEBEBFFCD3B11E28F09001B38C3836C.NASL description freedesktop.org reports : Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org last seen 2020-06-01 modified 2020-06-02 plugin id 66798 published 2013-06-05 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66798 title FreeBSD : xorg -- protocol handling issues in X Window System client libraries (2eebebff-cd3b-11e2-8f09-001b38c3836c) NASL family Solaris Local Security Checks NASL id SOLARIS11_XORG_20130924.NASL description The remote Solaris system is missing necessary patches to address security updates : - Integer overflow in X.org libXfixes 5.0 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XFixesGetCursorImage function. (CVE-2013-1983) - Multiple integer overflows in X.org libXrandr 1.4.0 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRRQueryOutputProperty and (2) XRRQueryProviderProperty functions. (CVE-2013-1986) - Multiple integer overflows in X.org libXrender 0.9.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRenderQueryFilters, (2) XRenderQueryFormats, and (3) XRenderQueryPictIndexValues functions. (CVE-2013-1987) - Multiple integer overflows in X.org libXRes 1.0.6 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XResQueryClients and (2) XResQueryClientResources functions. (CVE-2013-1988) - Multiple integer overflows in X.org libXv 1.0.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XvQueryPortAttributes, (2) XvListImageFormats, and (3) XvCreateImage function. (CVE-2013-1989) - Multiple integer overflows in X.org libXvMC 1.0.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XvMCListSurfaceTypes and (2) XvMCListSubpictureTypes functions. (CVE-2013-1990) - Multiple integer overflows in X.org libdmx 1.1.2 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) DMXGetScreenAttributes, (2) DMXGetWindowAttributes, and (3) DMXGetInputAttributes functions. (CVE-2013-1992) - Multiple integer overflows in X.org libGLX in Mesa 9.1.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XF86DRIOpenConnection and (2) XF86DRIGetClientDriverName functions. (CVE-2013-1993) - Buffer overflow in X.org libXvMC 1.0.7 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the XvMCGetDRInfo function. (CVE-2013-1999) - Multiple buffer overflows in X.org libXxf86dga 1.1.3 and earlier allow X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the (1) XDGAQueryModes and (2) XDGASetMode functions. (CVE-2013-2000) - Buffer overflow in X.org libXxf86vm 1.1.2 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the XF86VidModeGetGammaRamp function. (CVE-2013-2001) - Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the _XcursorFileHeaderCreate function. (CVE-2013-2003) - Integer overflow in X.org libXtst 1.2.1 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XRecordGetContext function. (CVE-2013-2063) - Integer overflow in X.org libxcb 1.9 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the read_packet function. (CVE-2013-2064) - Buffer overflow in X.org libXv 1.0.7 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the XvQueryPortAttributes function. (CVE-2013-2066) last seen 2020-06-01 modified 2020-06-02 plugin id 80819 published 2015-01-19 reporter This script is Copyright (C) 2015-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/80819 title Oracle Solaris Third-Party Patch Update : xorg (multiple_vulnerabilities_in_x_org) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2014-1436.NASL description Updated X11 client libraries packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The X11 (Xorg) libraries provide library routines that are used within all X Window applications. Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol data to an X11 server via a malicious X11 client could use either of these flaws to potentially escalate their privileges on the system. (CVE-2013-1981, CVE-2013-1982, CVE-2013-1983, CVE-2013-1984, CVE-2013-1985, CVE-2013-1986, CVE-2013-1987, CVE-2013-1988, CVE-2013-1989, CVE-2013-1990, CVE-2013-1991, CVE-2013-2003, CVE-2013-2062, CVE-2013-2064) Multiple array index errors, leading to heap-based buffer out-of-bounds write flaws, were found in the way various X11 client libraries handled data returned from an X11 server. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client. (CVE-2013-1997, CVE-2013-1998, CVE-2013-1999, CVE-2013-2000, CVE-2013-2001, CVE-2013-2002, CVE-2013-2066) A buffer overflow flaw was found in the way the XListInputDevices() function of X.Org X11 last seen 2020-06-01 modified 2020-06-02 plugin id 79182 published 2014-11-12 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79182 title CentOS 6 : libX11 / libXcursor / libXext / libXfixes / libXi / libXinerama / libXp / libXrandr / etc (CESA-2014:1436) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2014-1436.NASL description Updated X11 client libraries packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The X11 (Xorg) libraries provide library routines that are used within all X Window applications. Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol data to an X11 server via a malicious X11 client could use either of these flaws to potentially escalate their privileges on the system. (CVE-2013-1981, CVE-2013-1982, CVE-2013-1983, CVE-2013-1984, CVE-2013-1985, CVE-2013-1986, CVE-2013-1987, CVE-2013-1988, CVE-2013-1989, CVE-2013-1990, CVE-2013-1991, CVE-2013-2003, CVE-2013-2062, CVE-2013-2064) Multiple array index errors, leading to heap-based buffer out-of-bounds write flaws, were found in the way various X11 client libraries handled data returned from an X11 server. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client. (CVE-2013-1997, CVE-2013-1998, CVE-2013-1999, CVE-2013-2000, CVE-2013-2001, CVE-2013-2002, CVE-2013-2066) A buffer overflow flaw was found in the way the XListInputDevices() function of X.Org X11 last seen 2020-06-01 modified 2020-06-02 plugin id 78411 published 2014-10-14 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78411 title RHEL 6 : X11 client libraries (RHSA-2014:1436) NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-508.NASL description This update of libXvMC fixes several integer overflow issues. - U_0001-integer-overflow-in-XvMCListSurfaceTypes-CVE-2013 -19.patch, U_0002-integer-overflow-in-XvMCListSubpictureTypes-CVE-2 013.patch - integer overflow in XvMCListSurfaceTypes(), XvMCListSubpictureTypes() [CVE-2013-1990] (bnc#821663, bnc#815451) - U_0001-Multiple-unvalidated-assumptions-in-XvMCGetDRInfo -CV.patch - Multiple unvalidated assumptions in XvMCGetDRInfo() [CVE-2013-1999] (bnc#821663, bnc#815451) last seen 2020-06-05 modified 2014-06-13 plugin id 75044 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75044 title openSUSE Security Update : libXvMC (openSUSE-SU-2013:1025-1) NASL family SuSE Local Security Checks NASL id SUSE_11_XORG-X11-DEVEL-130625.NASL description This update of xorg-x11-libs fixes several integer and buffer overflow issues. Bug 815451/821663 CVE-2013-1984 / CVE-2013-1985 / CVE-2013-1986 / CVE-2013-1988 / CVE-2013-1990 / CVE-2013-1991 / CVE-2013-1992 / CVE-2013-1995 / CVE-2013-1996 / CVE-2013-1998 / CVE-2013-1999 / CVE-2013-2000 / CVE-2013-2001 / CVE-2013-2003 / CVE-2013-2063 last seen 2020-06-05 modified 2013-07-30 plugin id 69112 published 2013-07-30 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/69112 title SuSE 11.3 Security Update : xorg-x11-libs (SAT Patch Number 7944) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1868-1.NASL description Ilja van Sprundel discovered multiple security issues in various X.org libraries and components. An attacker could use these issues to cause applications to crash, resulting in a denial of service, or possibly execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 66832 published 2013-06-06 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66832 title Ubuntu 12.04 LTS / 12.10 / 13.04 : libxvmc vulnerabilities (USN-1868-1) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2675.NASL description Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to privilege escalation or denial of service. last seen 2020-03-17 modified 2013-05-24 plugin id 66559 published 2013-05-24 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66559 title Debian DSA-2675-2 : libxvmc - several vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2013-9099.NASL description Update to latest git to fix the following CVEs: CVE-2013-1999 CVE-2013-1990 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-05-28 plugin id 66613 published 2013-05-28 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/66613 title Fedora 19 : libXvMC-1.0.7-6.20130524gite9415ddef.fc19 (2013-9099) NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2014-452.NASL description Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol data to an X11 server via a malicious X11 client could use either of these flaws to potentially escalate their privileges on the system. (CVE-2013-1981 , CVE-2013-1982 , CVE-2013-1983 , CVE-2013-1984 , CVE-2013-1985 , CVE-2013-1986 , CVE-2013-1987 , CVE-2013-1988 , CVE-2013-1989 , CVE-2013-1990 , CVE-2013-1991 , CVE-2013-2003 , CVE-2013-2062 , CVE-2013-2064) Multiple array index errors, leading to heap-based buffer out-of-bounds write flaws, were found in the way various X11 client libraries handled data returned from an X11 server. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client. (CVE-2013-1997 , CVE-2013-1998 , CVE-2013-1999 , CVE-2013-2000 , CVE-2013-2001 , CVE-2013-2002 , CVE-2013-2066) A buffer overflow flaw was found in the way the XListInputDevices() function of X.Org X11 last seen 2020-06-01 modified 2020-06-02 plugin id 79560 published 2014-11-26 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79560 title Amazon Linux AMI : libX11 / libXcursor,libXfixes,libXi,libXrandr,libXrender,libXres,libXt,libXv,libXvMC,libXxf86dga,libXxf86vm,libdmx,xorg-x11-proto-devel (ALAS-2014-452) NASL family Fedora Local Security Checks NASL id FEDORA_2013-9117.NASL description Update to latest git to fix the following CVEs: CVE-2013-1999 CVE-2013-1990 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-06-03 plugin id 66746 published 2013-06-03 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/66746 title Fedora 18 : libXvMC-1.0.7-6.20130524gite9415ddef.fc18 (2013-9117) NASL family SuSE Local Security Checks NASL id SUSE_XORG-X11-8623.NASL description This update of xorg-x11 fixes several security vulnerabilities. - Bug 815451- X.Org Security Advisory: May 23, 2013 - Bug 821664 - libX11 - Bug 821671 - libXv - Bug 821670 - libXt - Bug 821669 - libXrender - Bug 821668 - libXp - Bug 821667 - libXfixes - Bug 821665 - libXext - Bug 821663 - libFS, libXcursor, libXi, libXinerama, libXRes, libXtst, libXvMC, libXxf86dga, libXxf86vm, libdmx last seen 2020-06-05 modified 2013-07-12 plugin id 67256 published 2013-07-12 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67256 title SuSE 10 Security Update : xorg-x11 (ZYPP Patch Number 8623) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201405-07.NASL description The remote host is affected by the vulnerability described in GLSA-201405-07 (X.Org X Server: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in X.Org X Server. Please review the CVE identifiers referenced below for details. Impact : A context-dependent attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or obtain sensitive information. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 74028 published 2014-05-16 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/74028 title GLSA-201405-07 : X.Org X Server: Multiple vulnerabilities NASL family Scientific Linux Local Security Checks NASL id SL_20141014_X11_CLIENT_LIBRARIES_ON_SL6_X.NASL description Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol data to an X11 server via a malicious X11 client could use either of these flaws to potentially escalate their privileges on the system. (CVE-2013-1981, CVE-2013-1982, CVE-2013-1983, CVE-2013-1984, CVE-2013-1985, CVE-2013-1986, CVE-2013-1987, CVE-2013-1988, CVE-2013-1989, CVE-2013-1990, CVE-2013-1991, CVE-2013-2003, CVE-2013-2062, CVE-2013-2064) Multiple array index errors, leading to heap-based buffer out-of-bounds write flaws, were found in the way various X11 client libraries handled data returned from an X11 server. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client. (CVE-2013-1997, CVE-2013-1998, CVE-2013-1999, CVE-2013-2000, CVE-2013-2001, CVE-2013-2002, CVE-2013-2066) A buffer overflow flaw was found in the way the XListInputDevices() function of X.Org X11 last seen 2020-03-18 modified 2014-11-04 plugin id 78841 published 2014-11-04 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78841 title Scientific Linux Security Update : X11 client libraries on SL6.x i386/x86_64 (20141014)
Redhat
| rpms |
|
References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106766.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00153.html
- http://www.debian.org/security/2013/dsa-2675
- http://www.openwall.com/lists/oss-security/2013/05/23/3
- http://www.ubuntu.com/usn/USN-1868-1
- http://www.x.org/wiki/Development/Security/Advisory-2013-05-23