Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name MDVSA-2013:260 First vendor Publication 2013-10-28
Vendor Mandriva Last vendor Modification 2013-10-28
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:H/Au:S/C:C/I:C/A:C)
Cvss Base Score 7.1 Attack Range Network
Cvss Impact Score 10 Attack Complexity High
Cvss Expoit Score 3.9 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple vulnerabilities has been discovered and corrected in x11-server:

The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition (CVE-2010-1166).

The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists (CVE-2011-4028).

The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file (CVE-2011-4029).

X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device, which might allow physically proximate attackers to obtain sensitive information, as demonstrated by reading passwords from a tty (CVE-2013-1940).

Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure (CVE-2013-4396).

The updated packages have been patched to correct these issues.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2013:260

CWE : Common Weakness Enumeration

% Id Name
20 % CWE-399 Resource Management Errors
20 % CWE-362 Race Condition
20 % CWE-264 Permissions, Privileges, and Access Controls
20 % CWE-189 Numeric Errors (CWE/SANS Top 25)
20 % CWE-59 Improper Link Resolution Before File Access ('Link Following')

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10112
 
Oval ID: oval:org.mitre.oval:def:10112
Title: The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.
Description: The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.
Family: unix Class: vulnerability
Reference(s): CVE-2010-1166
Version: 5
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:12600
 
Oval ID: oval:org.mitre.oval:def:12600
Title: USN-939-1 -- xorg-server vulnerabilities
Description: Loïc Minier discovered that xvfb-run did not correctly keep the X.org session cookie private. A local attacker could gain access to any local sessions started by xvfb-run. Ubuntu 9.10 was not affected. It was discovered that the X.org server did not correctly handle certain calculations. A remote attacker could exploit this to crash the X.org session or possibly run arbitrary code with root privileges
Family: unix Class: patch
Reference(s): USN-939-1
CVE-2009-1573
CVE-2010-1166
Version: 5
Platform(s): Ubuntu 8.04
Ubuntu 9.04
Ubuntu 9.10
Product(s): xorg-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:17813
 
Oval ID: oval:org.mitre.oval:def:17813
Title: DSA-2661-1 xorg-server - information disclosure
Description: David Airlie and Peter Hutterer of Red Hat discovered that xorg-server, the X.Org X server was vulnerable to an information disclosure flaw related to input handling and devices hotplug.
Family: unix Class: patch
Reference(s): DSA-2661-1
CVE-2013-1940
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
Product(s): xorg-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:18285
 
Oval ID: oval:org.mitre.oval:def:18285
Title: USN-1803-1 -- xorg-server, xorg-server-lts-quantal vulnerability
Description: The X server could be made to reveal keystrokes of other users.
Family: unix Class: patch
Reference(s): USN-1803-1
CVE-2013-1940
Version: 5
Platform(s): Ubuntu 12.10
Ubuntu 12.04
Ubuntu 11.10
Ubuntu 10.04
Product(s): xorg-server
xorg-server-lts-quantal
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:19497
 
Oval ID: oval:org.mitre.oval:def:19497
Title: DSA-2784-1 xorg-server - use-after-free
Description: Pedro Ribeiro discovered a use-after-free in the handling of ImageText requests in the Xorg X server, which could result in denial of service or privilege escalation.
Family: unix Class: patch
Reference(s): DSA-2784-1
CVE-2013-4396
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
Product(s): xorg-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20337
 
Oval ID: oval:org.mitre.oval:def:20337
Title: USN-1232-2 -- xorg-server regression
Description: USN-1232-1 caused a regression with GLX support.
Family: unix Class: patch
Reference(s): USN-1232-2
CVE-2010-4818
CVE-2010-4819
CVE-2011-4028
CVE-2011-4029
Version: 5
Platform(s): Ubuntu 10.04
Product(s): xorg-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:20825
 
Oval ID: oval:org.mitre.oval:def:20825
Title: USN-1232-1 -- xorg-server vulnerabilities
Description: The X server could be made to crash, run programs as an administrator, or read arbitrary files.
Family: unix Class: patch
Reference(s): USN-1232-1
CVE-2010-4818
CVE-2010-4819
CVE-2011-4028
CVE-2011-4029
Version: 5
Platform(s): Ubuntu 11.10
Ubuntu 11.04
Ubuntu 10.10
Ubuntu 10.04
Product(s): xorg-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21134
 
Oval ID: oval:org.mitre.oval:def:21134
Title: RHSA-2013:1426: xorg-x11-server security update (Important)
Description: Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
Family: unix Class: patch
Reference(s): RHSA-2013:1426-00
CESA-2013:1426
CVE-2013-4396
Version: 4
Platform(s): Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 5
CentOS Linux 5
CentOS Linux 6
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21169
 
Oval ID: oval:org.mitre.oval:def:21169
Title: RHSA-2012:0939: xorg-x11-server security and bug fix update (Low)
Description: The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.
Family: unix Class: patch
Reference(s): RHSA-2012:0939-04
CESA-2012:0939
CVE-2011-4028
CVE-2011-4029
Version: 29
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21211
 
Oval ID: oval:org.mitre.oval:def:21211
Title: USN-1232-3 -- xorg-server vulnerability
Description: The X server could be made to crash or run programs as an administrator.
Family: unix Class: patch
Reference(s): USN-1232-3
CVE-2010-4818
CVE-2010-4819
CVE-2011-4028
CVE-2011-4029
Version: 5
Platform(s): Ubuntu 10.10
Ubuntu 10.04
Product(s): xorg-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:21666
 
Oval ID: oval:org.mitre.oval:def:21666
Title: Vulnerability in the X server on AIX
Description: Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
Family: unix Class: vulnerability
Reference(s): CVE-2013-4396
Version: 3
Platform(s): IBM AIX 6.1
IBM AIX 7.1
Product(s):
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22204
 
Oval ID: oval:org.mitre.oval:def:22204
Title: RHSA-2010:0382: xorg-x11-server security update (Important)
Description: The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.
Family: unix Class: patch
Reference(s): RHSA-2010:0382-01
CESA-2010:0382
CVE-2010-1166
Version: 4
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23039
 
Oval ID: oval:org.mitre.oval:def:23039
Title: DEPRECATED: ELSA-2013:1426: xorg-x11-server security update (Important)
Description: Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
Family: unix Class: patch
Reference(s): ELSA-2013:1426-01
CVE-2013-4396
Version: 7
Platform(s): Oracle Linux 6
Oracle Linux 5
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23049
 
Oval ID: oval:org.mitre.oval:def:23049
Title: ELSA-2010:0382: xorg-x11-server security update (Important)
Description: The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.
Family: unix Class: patch
Reference(s): ELSA-2010:0382-01
CVE-2010-1166
Version: 6
Platform(s): Oracle Linux 5
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23899
 
Oval ID: oval:org.mitre.oval:def:23899
Title: ELSA-2012:0939: xorg-x11-server security and bug fix update (Low)
Description: The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.
Family: unix Class: patch
Reference(s): ELSA-2012:0939-04
CVE-2011-4028
CVE-2011-4029
Version: 13
Platform(s): Oracle Linux 6
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24142
 
Oval ID: oval:org.mitre.oval:def:24142
Title: ELSA-2013:1426: xorg-x11-server security update (Important)
Description: Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
Family: unix Class: patch
Reference(s): ELSA-2013:1426-01
CVE-2013-4396
Version: 6
Platform(s): Oracle Linux 6
Oracle Linux 5
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25467
 
Oval ID: oval:org.mitre.oval:def:25467
Title: SUSE-SU-2014:0744-1 -- Security update for xorg-x11-server
Description: This is a SLES 11 SP1 LTSS rollup update for the X.Org Server package. The following security issues have been fixed: * CVE-2013-6424: Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allowed context-dependent attackers to cause a denial of service (crash) via a negative bottom value. * CVE-2013-4396: Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allowed remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure. * CVE-2013-1940: X.Org X server did not properly restrict access to input events when adding a new hot-plug device, which might have allowed physically proximate attackers to obtain sensitive information, as demonstrated by reading passwords from a tty.
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0744-1
CVE-2013-6424
CVE-2013-4396
CVE-2013-1940
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25886
 
Oval ID: oval:org.mitre.oval:def:25886
Title: SUSE-SU-2013:0859-1 -- Security update for Xorg
Description: This update of xorg-x11-server fixes one security issue and two bugs.
Family: unix Class: patch
Reference(s): SUSE-SU-2013:0859-1
CVE-2013-1940
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
Product(s): Xorg
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26026
 
Oval ID: oval:org.mitre.oval:def:26026
Title: SUSE-SU-2013:0857-1 -- Security update for xorg-x11-server
Description: In some cases, input events are sent to X servers not currently the VT owner, allowing a user to capture passwords. This update fixes this issue. CVE-2013-1940 has been assigned to this issue. Security Issue reference: * CVE-2013-1940 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1940 >
Family: unix Class: patch
Reference(s): SUSE-SU-2013:0857-1
CVE-2013-1940
Version: 3
Platform(s): SUSE Linux Enterprise Server 10
SUSE Linux Enterprise Desktop 10
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26508
 
Oval ID: oval:org.mitre.oval:def:26508
Title: ELSA-2013-1620 -- xorg-x11-server security and bug fix update (low)
Description: [1.13.0-23] - Fix root window damage reports when Xinerama is active (#919165)
Family: unix Class: patch
Reference(s): ELSA-2013-1620
CVE-2013-1940
Version: 3
Platform(s): Oracle Linux 6
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26909
 
Oval ID: oval:org.mitre.oval:def:26909
Title: DEPRECATED: ELSA-2012-0939 -- xorg-x11-server security and bug fix update (low)
Description: [1.10.6-1] - xserver 1.10.6 - Use git-style patch names - compsize.h, glxcmds.h: Copy from upstream git since they fell out of the upstream tarball [1.10.4-15] - Undo regression introduced in Patch8007 (#732467) [1.10.4-14] - xserver-1.10.4-sync-revert.patch: Revert an edge-case change in IDLETIME that appears to be more wrong than right. (#748704) [1.10.4-13] - xserver-1.10.4-randr-corner-case.patch: Fix a corner case in initial mode selection. (#657580) - xserver-1.10.4-vbe-no-cache-ddc-support.patch: Only interpret complete non-support for DDC extension as 'DDC unavailable'. (#657580) [1.10.4-11] - xserver-1.10.4-dix-when-rescaling-from-master-rescale-from-desktop-.patch: fix rescaling from master to slave if the pointer (#732467) [1.10.4-10] - Add patches to change the screen crossing behaviour for multiple ScreenRecs (#732467) - remove the xorg.conf.man page from our .gitignore - we need to patch it now and its part of the upstream distribution [1.10.4-9] - xserver-1.10.4-no-24bpp-xaa-composite.patch: Disable Composite at 24bpp in XAA (#651934) [1.10.4-8] - xserver-1.10.4-fb-picture-crash.patch: Fix crash on invalid pictures (#722680) [1.10.4-7] - fix xephyr rendering when using two screens (#757792)
Family: unix Class: patch
Reference(s): ELSA-2012-0939
CVE-2011-4028
CVE-2011-4029
Version: 4
Platform(s): Oracle Linux 6
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:26975
 
Oval ID: oval:org.mitre.oval:def:26975
Title: RHSA-2012:0303 -- xorg-x11-server security and bug fix update (Low)
Description: X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack. (CVE-2011-4028) Red Hat would like to thank the researcher with the nickname vladz for reporting this issue. This update also fixes the following bugs: * In rare cases, if the front and back buffer of the miDbePositionWindow() function were not both allocated in video memory, or were both allocated in system memory, the X Window System sometimes terminated unexpectedly. A patch has been provided to address this issue and X no longer crashes in the described scenario. (BZ#596899) * Previously, when the miSetShape() function called the miRegionDestroy() function with a NULL region, X terminated unexpectedly if the backing store was enabled. Now, X no longer crashes in the described scenario. (BZ#676270) * On certain workstations running in 32-bit mode, the X11 mouse cursor occasionally became stuck near the left edge of the X11 screen. A patch has been provided to address this issue and the mouse cursor no longer becomes stuck in the described scenario. (BZ#529717) * On certain workstations with a dual-head graphics adapter using the r500 driver in Zaphod mode, the mouse pointer was confined to one monitor screen and could not move to the other screen. A patch has been provided to address this issue and the mouse cursor works properly across both screens. (BZ#559964) * Due to a double free operation, Xvfb (X virtual framebuffer) terminated unexpectedly with a segmentation fault randomly when the last client disconnected, that is when the server reset. This bug has been fixed in the miDCCloseScreen() function and Xvfb no longer crashes. (BZ#674741) * Starting the Xephyr server on an AMD64 or Intel 64 architecture with an integrated graphics adapter caused the server to terminate unexpectedly. This bug has been fixed in the code and Xephyr no longer crashes in the described scenario. (BZ#454409) * Previously, when a client made a request bigger than 1/4th of the limit advertised in the BigRequestsEnable reply, the X server closed the connection unexpectedly. With this update, the maxBigRequestSize variable has been added to the code to check the size of client requests, thus fixing this bug. (BZ#555000) * When an X client running on a big-endian system called the XineramaQueryScreens() function, the X server terminated unexpectedly. This bug has been fixed in the xf86Xinerama module and the X server no longer crashes in the described scenario. (BZ#588346) * When installing Red Hat Enterprise Linux 5 on an IBM eServer System p blade server, the installer did not set the correct mode on the built-in KVM (Keyboard-Video-Mouse). Consequently, the graphical installer took a very long time to appear and then was displayed incorrectly. A patch has been provided to address this issue and the graphical installer now works as expected in the described scenario. Note that this fix requires the Red Hat Enterprise Linux 5.8 kernel update. (BZ#740497) * Lines longer than 46,340 pixels can be drawn with one of the coordinates being negative. However, for dashed lines, the miPolyBuildPoly() function overflowed the &quot;int&quot; type when setting up edges for a section of a dashed line. Consequently, dashed segments were not drawn at all. An upstream patch has been applied to address this issue and dashed lines are now drawn correctly. (BZ#649810) All users of xorg-x11-server are advised to upgrade to these updated packages, which correct these issues. All running X.Org server instances must be restarted for this update to take effect.
Family: unix Class: patch
Reference(s): RHSA-2012:0303
CVE-2011-4028
Version: 3
Platform(s): Red Hat Enterprise Linux 5
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27049
 
Oval ID: oval:org.mitre.oval:def:27049
Title: RHSA-2013:1620 -- xorg-x11-server security and bug fix update (Low)
Description: X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. A flaw was found in the way the X.org X11 server registered new hot plugged devices. If a local user switched to a different session and plugged in a new device, input from that device could become available in the previous session, possibly leading to information disclosure. (CVE-2013-1940) This issue was found by David Airlie and Peter Hutterer of Red Hat. This update also fixes the following bugs: * A previous upstream patch modified the Xephyr X server to be resizeable, however, it did not enable the resize functionality by default. As a consequence, X sandboxes were not resizeable on Red Hat Enterprise Linux 6.4 and later. This update enables the resize functionality by default so that X sandboxes can now be resized as expected. (BZ#915202) * In Red Hat Enterprise Linux 6, the X Security extension (XC-SECURITY) has been disabled and replaced by X Access Control Extension (XACE). However, XACE does not yet include functionality that was previously available in XC-SECURITY. With this update, XC-SECURITY is enabled in the xorg-x11-server spec file on Red Hat Enterprise Linux 6. (BZ#957298) * Upstream code changes to extension initialization accidentally disabled the GLX extension in Xvfb (the X virtual frame buffer), rendering headless 3D applications not functional. An upstream patch to this problem has been backported so the GLX extension is enabled again, and applications relying on this extension work as expected. (BZ#969538) All xorg-x11-server users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
Family: unix Class: patch
Reference(s): RHSA-2013:1620
CESA-2013:1620
CVE-2013-1940
Version: 3
Platform(s): Red Hat Enterprise Linux 6
CentOS Linux 6
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27472
 
Oval ID: oval:org.mitre.oval:def:27472
Title: DEPRECATED: ELSA-2013-1426 -- xorg-x11-server security update (important)
Description: [1.13.0-11.1.2] - CVE-2013-4396: Fix use-after free in ImageText requests (#1014561)
Family: unix Class: patch
Reference(s): ELSA-2013-1426
CVE-2013-4396
Version: 4
Platform(s): Oracle Linux 5
Oracle Linux 6
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27652
 
Oval ID: oval:org.mitre.oval:def:27652
Title: ELSA-2012-0303 -- xorg-x11-server security and bug fix update (low)
Description: [1.1.1-48.90.0.1.el5] - Added oracle-enterprise-detect.patch - Replaced 'Red Hat' in spec file [1.1.1-48.90] - cve-2011-4028.patch: File existence disclosure vulnerability.
Family: unix Class: patch
Reference(s): ELSA-2012-0303
CVE-2011-4028
Version: 3
Platform(s): Oracle Linux 5
Product(s): xorg-x11-server
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28180
 
Oval ID: oval:org.mitre.oval:def:28180
Title: DEPRECATED: ELSA-2010-0382 -- xorg-x11-server security update (important)
Description: [1.1.1-48.76.0.1.el5_5.1 ] - Added oracle-enterprise-detect.patch - Replaced 'Red Hat' in spec file [1.1.1-48.76.1] - xserver-1.1.1-mod-macro-parens.patch: Fix insufficient parentheses in Render and arc computation code. (#495733)
Family: unix Class: patch
Reference(s): ELSA-2010-0382
CVE-2010-1166
Version: 4
Platform(s): Oracle Linux 5
Product(s): xorg-x11-server
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 22
Application 5
Application 4
Os 4

ExploitDB Exploits

id Description
2011-10-28 Xorg 1.4 to 1.11.2 File Permission Change PoC

OpenVAS Exploits

Date Description
2012-08-02 Name : SuSE Update for xorg-x11-server openSUSE-SU-2012:0227-1 (xorg-x11-server)
File : nvt/gb_suse_2012_0227_1.nasl
2012-07-30 Name : CentOS Update for xorg-x11-server-common CESA-2012:0939 centos6
File : nvt/gb_CESA-2012_0939_xorg-x11-server-common_centos6.nasl
2012-06-22 Name : RedHat Update for xorg-x11-server RHSA-2012:0939-04
File : nvt/gb_RHSA-2012_0939-04_xorg-x11-server.nasl
2012-02-21 Name : RedHat Update for xorg-x11-server RHSA-2012:0303-03
File : nvt/gb_RHSA-2012_0303-03_xorg-x11-server.nasl
2012-02-12 Name : Gentoo Security Advisory GLSA 201110-19 (xorg-server)
File : nvt/glsa_201110_19.nasl
2011-10-21 Name : Ubuntu Update for xorg-server USN-1232-1
File : nvt/gb_ubuntu_USN_1232_1.nasl
2011-10-21 Name : Ubuntu Update for xorg-server USN-1232-2
File : nvt/gb_ubuntu_USN_1232_2.nasl
2011-10-21 Name : Ubuntu Update for xorg-server USN-1232-3
File : nvt/gb_ubuntu_USN_1232_3.nasl
2011-08-09 Name : CentOS Update for xorg-x11-server-sdk CESA-2010:0382 centos5 i386
File : nvt/gb_CESA-2010_0382_xorg-x11-server-sdk_centos5_i386.nasl
2010-05-28 Name : Ubuntu Update for xorg-server vulnerabilities USN-939-1
File : nvt/gb_ubuntu_USN_939_1.nasl
2010-04-30 Name : RedHat Update for xorg-x11-server RHSA-2010:0382-01
File : nvt/gb_RHSA-2010_0382-01_xorg-x11-server.nasl
0000-00-00 Name : FreeBSD Ports: xorg-server
File : nvt/freebsd_xorg-server2.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
76669 X.Org xserver os/utils.c LockServer() Function Race Condition Symlink Arbitra...

76668 X.Org xserver os/utils.c LockServer() Function File Locking Symlink File Enum...

64246 X.Org X11 X Server Render Extension fbpict.c fbComposite Function Macro Defin...

Nessus® Vulnerability Scanner

Date Description
2015-05-20 Name : The remote SUSE host is missing one or more security updates.
File : suse_SU-2013-0857-1.nasl - Type : ACT_GATHER_INFO
2015-03-27 Name : The remote Fedora host is missing a security update.
File : fedora_2015-3948.nasl - Type : ACT_GATHER_INFO
2015-03-27 Name : The remote Fedora host is missing a security update.
File : fedora_2015-3964.nasl - Type : ACT_GATHER_INFO
2015-03-23 Name : The remote Fedora host is missing a security update.
File : fedora_2015-3953.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_xorg_20120417.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_xorg_20141014.nasl - Type : ACT_GATHER_INFO
2014-11-12 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1620.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-411.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-807.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_3_xorg-x11-Xvnc-100819.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : suse_11_3_xorg-x11-Xvnc-111201.nasl - Type : ACT_GATHER_INFO
2014-05-16 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201405-07.nasl - Type : ACT_GATHER_INFO
2014-02-05 Name : The remote AIX host is missing a security patch.
File : aix_IV53246.nasl - Type : ACT_GATHER_INFO
2014-02-05 Name : The remote AIX host is missing a security patch.
File : aix_IV52978.nasl - Type : ACT_GATHER_INFO
2014-01-22 Name : The remote AIX host is missing a security patch.
File : aix_IV52181.nasl - Type : ACT_GATHER_INFO
2014-01-22 Name : The remote AIX host is missing a security patch.
File : aix_IV52185.nasl - Type : ACT_GATHER_INFO
2014-01-22 Name : The remote AIX host is missing a security patch.
File : aix_IV52186.nasl - Type : ACT_GATHER_INFO
2014-01-22 Name : The remote AIX host is missing a security patch.
File : aix_IV52184.nasl - Type : ACT_GATHER_INFO
2014-01-22 Name : The remote AIX host is missing a security patch.
File : aix_IV53331.nasl - Type : ACT_GATHER_INFO
2013-12-14 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-260.nasl - Type : ACT_GATHER_INFO
2013-12-10 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131121_xorg_x11_server_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2013-11-29 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1620.nasl - Type : ACT_GATHER_INFO
2013-11-21 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1620.nasl - Type : ACT_GATHER_INFO
2013-11-19 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_xorg-x11-Xvnc-131022.nasl - Type : ACT_GATHER_INFO
2013-11-14 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2013-234.nasl - Type : ACT_GATHER_INFO
2013-10-29 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2013-259.nasl - Type : ACT_GATHER_INFO
2013-10-25 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_9a57c6073cab11e3b4d9bcaec565249c.nasl - Type : ACT_GATHER_INFO
2013-10-23 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2784.nasl - Type : ACT_GATHER_INFO
2013-10-18 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1990-1.nasl - Type : ACT_GATHER_INFO
2013-10-17 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20131015_xorg_x11_server_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2013-10-17 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2013-1426.nasl - Type : ACT_GATHER_INFO
2013-10-16 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2013-1426.nasl - Type : ACT_GATHER_INFO
2013-10-16 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-1426.nasl - Type : ACT_GATHER_INFO
2013-10-15 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2013-287-05.nasl - Type : ACT_GATHER_INFO
2013-09-04 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2012-104.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Fedora host is missing a security update.
File : fedora_2013-5967.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2010-0382.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-0303.nasl - Type : ACT_GATHER_INFO
2013-07-12 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2012-0939.nasl - Type : ACT_GATHER_INFO
2013-06-05 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_xorg-x11-Xvnc-130524.nasl - Type : ACT_GATHER_INFO
2013-06-05 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_xorg-x11-server-8561.nasl - Type : ACT_GATHER_INFO
2013-04-30 Name : The remote Fedora host is missing a security update.
File : fedora_2013-5883.nasl - Type : ACT_GATHER_INFO
2013-04-22 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2013-109-01.nasl - Type : ACT_GATHER_INFO
2013-04-22 Name : The remote Fedora host is missing a security update.
File : fedora_2013-5928.nasl - Type : ACT_GATHER_INFO
2013-04-18 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2661.nasl - Type : ACT_GATHER_INFO
2013-04-18 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1803-1.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing a security update.
File : suse_11_xorg-x11-server-dmx-120410.nasl - Type : ACT_GATHER_INFO
2013-01-25 Name : The remote SuSE 11 host is missing a security update.
File : suse_11_xorg-x11-server-rdp-120410.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120221_xorg_x11_server_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20100428_xorg_x11_server_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20120620_xorg_x11_server_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-07-11 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2012-0939.nasl - Type : ACT_GATHER_INFO
2012-06-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0939.nasl - Type : ACT_GATHER_INFO
2012-02-21 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2012-0303.nasl - Type : ACT_GATHER_INFO
2011-12-13 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_xorg-x11-Xvnc-111124.nasl - Type : ACT_GATHER_INFO
2011-10-24 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201110-19.nasl - Type : ACT_GATHER_INFO
2011-10-21 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1232-3.nasl - Type : ACT_GATHER_INFO
2011-10-20 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1232-2.nasl - Type : ACT_GATHER_INFO
2011-10-19 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_8441957cf9b411e0a78abcaec565249c.nasl - Type : ACT_GATHER_INFO
2011-10-19 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-1232-1.nasl - Type : ACT_GATHER_INFO
2011-01-21 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_xorg-x11-Xvnc-100819.nasl - Type : ACT_GATHER_INFO
2010-10-11 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_xorg-x11-Xvnc-7126.nasl - Type : ACT_GATHER_INFO
2010-10-11 Name : The remote SuSE 10 host is missing a security-related patch.
File : suse_xorg-x11-7002.nasl - Type : ACT_GATHER_INFO
2010-10-06 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12638.nasl - Type : ACT_GATHER_INFO
2010-09-08 Name : The remote openSUSE host is missing a security update.
File : suse_11_2_xorg-x11-Xvnc-100805.nasl - Type : ACT_GATHER_INFO
2010-07-09 Name : The remote SuSE 9 host is missing a security-related patch.
File : suse9_12612.nasl - Type : ACT_GATHER_INFO
2010-06-01 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2010-0382.nasl - Type : ACT_GATHER_INFO
2010-05-19 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-939-1.nasl - Type : ACT_GATHER_INFO
2010-05-11 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2010-0382.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2013-10-28 21:19:53
  • First insertion