4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
26.7%
Severity: Medium
Date : 2017-10-08
CVE-ID : CVE-2017-13721 CVE-2017-13723
Package : xorg-server
Type : multiple issues
Remote : No
Link : https://security.archlinux.org/AVG-432
The package xorg-server before version 1.19.4-1 is vulnerable to
multiple issues including arbitrary code execution and denial of
service.
Upgrade to 1.19.4-1.
The problems have been fixed upstream in version 1.19.4.
None.
A denial of service vulnerability was found in xorg-server in the
ProcShmCreateSegment function due to a missing shmseg resource ids
validation. A passed shmseg resource id may belong to a non-existing
client and abort X server with FatalError “client not in use”, or
overwrite existing segment of another existing client.
A stack buffer overflow was found in xkbtext.c, which didn’t handle xkb
formatted string output safely due to a single shared static buffer.
The fix introduces a ring of resizable buffers to avoid problems when
strings end up longer than anticipated.
This vulnerability may potentially lead to privilege escalation when
the xorg-server is running with root privileges.
A local attacker is able to crash the xorg-server process leading to
denial of service or possibly elevate privileges when the xorg-server
is running with root privileges.
https://lists.x.org/archives/xorg-announce/2017-October/002808.html
https://cgit.freedesktop.org/xorg/xserver/commit/?id=b95f25af141d33a65f6f821ea9c003f66a01e1f1
https://cgit.freedesktop.org/xorg/xserver/commit/?id=94f11ca5cf011ef123bd222cabeaef6f424d76ac
https://security.archlinux.org/CVE-2017-13721
https://security.archlinux.org/CVE-2017-13723
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
ArchLinux | any | any | xorg-server | < 1.19.4-1 | UNKNOWN |
cgit.freedesktop.org/xorg/xserver/commit/?id=94f11ca5cf011ef123bd222cabeaef6f424d76ac
cgit.freedesktop.org/xorg/xserver/commit/?id=b95f25af141d33a65f6f821ea9c003f66a01e1f1
lists.x.org/archives/xorg-announce/2017-October/002808.html
security.archlinux.org/AVG-432
security.archlinux.org/CVE-2017-13721
security.archlinux.org/CVE-2017-13723
4.6 Medium
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
26.7%