Summary
It was discovered that the X.Org X server incorrectly handled endianness
conversion of certain X events. An attacker able to connect to an X server,
either locally or remotely, could use this issue to crash the server, or
possibly execute arbitrary code as an administrator. (CVE-2017-10971)
It was discovered that the X.Org X server incorrectly handled endianness
conversion of certain X events. An attacker able to connect to an X server,
either locally or remotely, could use this issue to possibly obtain
sensitive information. (CVE-2017-10972)
Eric Sesterhenn discovered that the X.Org X server incorrectly compared
MIT cookies. An attacker could possibly use this issue to perform a timing
attack and recover the MIT cookie. (CVE-2017-2624)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | xorg-server | 2:1.15.1-0ubuntu2.9 |
| Ubuntu · 14.04 LTS 14.04:LTS | xorg-server-lts-xenial | 2:1.18.3-1ubuntu2.3~trusty2 |
| Ubuntu · 16.04 LTS 16.04:LTS | xorg-server | 2:1.18.4-0ubuntu0.3 |
| Ubuntu · 16.04 LTS 16.04:LTS | xorg-server-hwe-16.04 | 2:1.18.4-1ubuntu6.1~16.04.2 |
Vulnerabilities 3
-
Medium 5.9
It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a seri…
-
Unscored —
In the X.Org X server before 2017-06-19, a user authenticated to an X Session could crash or execute code in the contex…
-
Unscored —
Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed auth…