ALT-PU-2020-2670-1
Package xorg-server updated to version 1.20.9-alt1 for branch sisyphus in task 256796.
Closed vulnerabilities
BDU:2020-03504
Уязвимость библиотеки шрифтов операционных систем Windows, позволяющая нарушителю выполнить произвольный код
BDU:2020-03915
Уязвимость сервера X Window System Xorg-server, связанная с некорректной инициализацией памяти, позволяющая нарушителю вызвать утечку части серверной памяти для клиента Xorg-server
BDU:2021-00126
Уязвимость функции SProcRecordQueryVersion сервера X Window System Xorg-server, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2021-00127
Уязвимость функции SProcXkbSelectEvents сервера X Window System Xorg-server, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2021-00128
Уязвимость функции ProcXIChangeHierarchy сервера X Window System Xorg-server, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании
BDU:2021-02598
Уязвимость функции XkbSetNamesCheck из xkb.c сервера X Window System Xorg-server, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю получить доступ к конфиденциальной информации или вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-14345
A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Out-Of-Bounds access in XkbSetNames function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- [oss-security] 20210115 Re: [vs] Cinnamon lock screen bypass in multiple distributions
- [oss-security] 20210115 Re: [vs] Cinnamon lock screen bypass in multiple distributions
- https://bugzilla.redhat.com/show_bug.cgi?id=1862241
- https://bugzilla.redhat.com/show_bug.cgi?id=1862241
- https://lists.x.org/archives/xorg-announce/2020-August/003058.html
- https://lists.x.org/archives/xorg-announce/2020-August/003058.html
- GLSA-202012-01
- GLSA-202012-01
- USN-4488-2
- USN-4488-2
- USN-4490-1
- USN-4490-1
- https://www.zerodayinitiative.com/advisories/ZDI-20-1416/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1416/
Modified: 2024-11-21
CVE-2020-14346
A flaw was found in xorg-x11-server before 1.20.9. An integer underflow in the X input extension protocol decoding in the X server may lead to arbitrary access of memory contents. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- https://bugzilla.redhat.com/show_bug.cgi?id=1862246
- https://bugzilla.redhat.com/show_bug.cgi?id=1862246
- https://lists.x.org/archives/xorg-announce/2020-August/003058.html
- https://lists.x.org/archives/xorg-announce/2020-August/003058.html
- GLSA-202012-01
- GLSA-202012-01
- USN-4488-2
- USN-4488-2
- https://www.zerodayinitiative.com/advisories/ZDI-20-1417/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1417/
Modified: 2024-11-21
CVE-2020-14347
A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable.
- openSUSE-SU-2020:1279
- openSUSE-SU-2020:1279
- openSUSE-SU-2020:1302
- openSUSE-SU-2020:1302
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14347
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14347
- [debian-lts-announce] 20200830 [SECURITY] [DLA 2359-1] xorg-server security update
- [debian-lts-announce] 20200830 [SECURITY] [DLA 2359-1] xorg-server security update
- https://lists.x.org/archives/xorg-announce/2020-July/003051.html
- https://lists.x.org/archives/xorg-announce/2020-July/003051.html
- GLSA-202012-01
- GLSA-202012-01
- USN-4488-1
- USN-4488-1
- USN-4488-2
- USN-4488-2
- DSA-4758
- DSA-4758
- https://www.openwall.com/lists/oss-security/2020/07/31/2
- https://www.openwall.com/lists/oss-security/2020/07/31/2
Modified: 2024-11-21
CVE-2020-1436
A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted fonts.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Windows Font Library Remote Code Execution Vulnerability'.
- [oss-security] 20200825 X.Org server security advisory: August 25, 2020
- [oss-security] 20200825 X.Org server security advisory: August 25, 2020
- [oss-security] 20200825 Re: X.Org server security advisory: August 25, 2020
- [oss-security] 20200825 Re: X.Org server security advisory: August 25, 2020
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1436
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1436
- https://www.zerodayinitiative.com/advisories/ZDI-20-877/
- https://www.zerodayinitiative.com/advisories/ZDI-20-877/
Modified: 2024-11-21
CVE-2020-14361
A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- https://bugzilla.redhat.com/show_bug.cgi?id=1869142
- https://bugzilla.redhat.com/show_bug.cgi?id=1869142
- https://lists.x.org/archives/xorg-announce/2020-August/003058.html
- https://lists.x.org/archives/xorg-announce/2020-August/003058.html
- GLSA-202012-01
- GLSA-202012-01
- USN-4488-2
- USN-4488-2
- https://www.zerodayinitiative.com/advisories/ZDI-20-1418/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1418/
Modified: 2024-11-21
CVE-2020-14362
A flaw was found in X.Org Server before xorg-x11-server 1.20.9. An Integer underflow leading to heap-buffer overflow may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
- https://bugzilla.redhat.com/show_bug.cgi?id=1869144
- https://bugzilla.redhat.com/show_bug.cgi?id=1869144
- https://lists.x.org/archives/xorg-announce/2020-August/003058.html
- https://lists.x.org/archives/xorg-announce/2020-August/003058.html
- GLSA-202012-01
- GLSA-202012-01
- USN-4488-2
- USN-4488-2
- https://www.zerodayinitiative.com/advisories/ZDI-20-1419/
- https://www.zerodayinitiative.com/advisories/ZDI-20-1419/