CVE-2018-14665

2018-10-2500:00:00

ubuntu.com

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.6 Medium

CVSS3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.041 Low

EPSS

Percentile

92.2%

JSON

A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission
check for -modulepath and -logfile options when starting Xorg. X server
allows unprivileged users with the ability to log in to the system via
physical console to escalate their privileges and run arbitrary code under
root privileges.

Notes

Author	Note
mdeslaur	xorg server is actually the xorg-server package the xorg package only contains docs introduced by: https://gitlab.freedesktop.org/xorg/xserver/commit/032b1d79b7

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchxorg-server< 2:1.19.6-1ubuntu4.2UNKNOWN
ubuntu18.10noarchxorg-server< 2:1.20.1-3ubuntu2.1UNKNOWN
ubuntu16.04noarchxorg-server-hwe-16.04< 2:1.19.6-1ubuntu4.1~16.04.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	xorg-server	< 2:1.19.6-1ubuntu4.2	UNKNOWN
ubuntu	18.10	noarch	xorg-server	< 2:1.20.1-3ubuntu2.1	UNKNOWN
ubuntu	16.04	noarch	xorg-server-hwe-16.04	< 2:1.19.6-1ubuntu4.1~16.04.2	UNKNOWN