CVE-2020-14344

Опубликовано: 05 авг. 2020

Источник: nvd

CVSS3: 6.7

CVSS2: 4.6

EPSS Низкий

Описание

An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00014.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00015.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00024.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00031.html
Mailing List
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14344
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4VDDSAYV7XGNRCXE7HCU23645MG74OFF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7AVXCQOSCAPKYYHFIJAZ6E2C7LJBTLXF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XY4H2SIEF2362AMNX5ZKWAELGU7LKFJB/
https://lists.x.org/archives/xorg-announce/2020-July/003050.html
Mailing List
Patch
Vendor Advisory
https://security.gentoo.org/glsa/202008-18
Third Party Advisory
https://usn.ubuntu.com/4487-1/
Third Party Advisory
https://usn.ubuntu.com/4487-2/
Third Party Advisory
https://www.openwall.com/lists/oss-security/2020/07/31/1
Mailing List
Patch
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00014.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00015.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00024.html
Mailing List
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00031.html
Mailing List
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14344
Issue Tracking
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4VDDSAYV7XGNRCXE7HCU23645MG74OFF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7AVXCQOSCAPKYYHFIJAZ6E2C7LJBTLXF/

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:x.org:libx11:*:*:*:*:*:*:*:*

Версия до 1.6.10 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*

EPSS

Процентиль: 19%

0.00059

Низкий

6.7 Medium

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-190

Связанные уязвимости

CVE-2020-14344

CVSS3: 6.7

ubuntu

почти 5 лет назад

CVE-2020-14344

CVSS3: 6.7

redhat

почти 5 лет назад

CVE-2020-14344

CVSS3: 6.7

debian

почти 5 лет назад

An integer overflow leading to a heap-buffer overflow was found in The ...

openSUSE-SU-2020:1198-1

suse-cvrf

почти 5 лет назад

Security update for libX11

openSUSE-SU-2020:1182-1

suse-cvrf

почти 5 лет назад

Security update for libX11

EPSS

Процентиль: 19%

0.00059

Низкий

6.7 Medium

CVSS3

4.6 Medium

CVSS2

Дефекты

CWE-190