Skip to content
OpenAdvisories
Unscored CVE-2021-3472 EUVD-2021-26794GHSA-cmmq-26gr-w7rc

A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privile…

Published Apr 26, 2021 · Updated Aug 3, 2024 · Assigned by redhat

Package: xorg-server Package: xorg-server Package: xorg-server Package: xorg-server-hwe-16.04 Package: xorg-server-hwe-18.04 Package: xorg-x11-server Package: xwayland Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

A flaw was found in xorg-x11-server in versions before 1.20.11. An integer underflow can occur in xserver which can lead to a local privilege escalation. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected products

VendorProductAffectedFixed
— xorg-x11-server xorg-x11-server 1.20.11 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 xorg-server 2:1.20.11-1 —
Debian 13 xorg-server 2:1.20.11-1 —
Debian 12 xorg-server 2:1.20.11-1 —
Debian 10 xorg-server 2:1.20.4-1+deb10u3 DSA-4893-1
Debian 9 xorg-server 2:1.19.2-1+deb9u8 DLA-2627-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS xorg-server 2:1.20.9-2ubuntu1.2~20.04.2 USN-4905-1
Ubuntu 18.04 LTS xorg-server 2:1.19.6-1ubuntu4.9 USN-4905-1
Ubuntu 18.04 LTS xorg-server-hwe-18.04 2:1.20.8-2ubuntu2.2~18.04.5 USN-4905-1
Ubuntu 16.04 LTS xorg-server 2:1.18.4-0ubuntu0.12 USN-4905-1
Ubuntu 16.04 LTS xorg-server-hwe-16.04 2:1.19.6-1ubuntu4.1~16.04.6 USN-4905-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 14.04 LTS xorg-server 2:1.15.1-0ubuntu2.11+esm4 USN-4905-2

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 xorg-x11-server +9 1.20.4-16.el7_9 RHSA-2021:2033

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP2 xorg-x11-server 1.20.3-22.5.25.1 SUSE-SU-2021:1182-1
SLES 15 SP1 xorg-x11-server 1.20.3-14.5.16.1 SUSE-SU-2021:1188-1
SLES 15 xorg-x11-server 1.19.6-8.30.1 SUSE-SU-2021:1179-1
SLES 12 SP5 xorg-x11-server 1.19.6-10.23.1 SUSE-SU-2021:1181-1
SLES 12 SP4 xorg-x11-server 1.19.6-4.22.1 SUSE-SU-2021:1180-1
Show 20 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP3 xorg-x11-server 7.6_1.18.3-76.40.1 SUSE-SU-2021:1187-1
SLES 12 SP2 xorg-x11-server 7.6_1.18.3-76.40.1 SUSE-SU-2021:1187-1
SLES 11 SP4 xorg-x11-server 7.4-27.122.40.1 SUSE-SU-2021:14690-1
SLES for SAP 15 SP1 xorg-x11-server 1.20.3-14.5.16.1 SUSE-SU-2021:1188-1
SLES for SAP 15 xorg-x11-server 1.19.6-8.30.1 SUSE-SU-2021:1179-1
SLES for SAP 12 SP5 xorg-x11-server 1.19.6-10.23.1 SUSE-SU-2021:1181-1
SLES for SAP 12 SP4 xorg-x11-server 1.19.6-4.22.1 SUSE-SU-2021:1180-1
SLES for SAP 12 SP3 xorg-x11-server 7.6_1.18.3-76.40.1 SUSE-SU-2021:1187-1
SLE HPC 15 SP1 xorg-x11-server 1.20.3-14.5.16.1 SUSE-SU-2021:1188-1
SLE HPC 15 xorg-x11-server 1.19.6-8.30.1 SUSE-SU-2021:1179-1
SUSE OpenStack Cloud Crowbar 9 xorg-x11-server 1.19.6-4.22.1 SUSE-SU-2021:1180-1
SUSE OpenStack Cloud Crowbar 8 xorg-x11-server 7.6_1.18.3-76.40.1 SUSE-SU-2021:1187-1
SUSE OpenStack Cloud 9 xorg-x11-server 1.19.6-4.22.1 SUSE-SU-2021:1180-1
SUSE OpenStack Cloud 8 xorg-x11-server 7.6_1.18.3-76.40.1 SUSE-SU-2021:1187-1
SUSE Manager Server 4.0 xorg-x11-server 1.20.3-14.5.16.1 SUSE-SU-2021:1188-1
SUSE Manager Retail Branch Server 4.0 xorg-x11-server 1.20.3-14.5.16.1 SUSE-SU-2021:1188-1
SUSE Manager Proxy 4.0 xorg-x11-server 1.20.3-14.5.16.1 SUSE-SU-2021:1188-1
SUSE Linux Enterprise Point of Sale 11 SP3 xorg-x11-server 7.4-27.122.40.1 SUSE-SU-2021:14690-1
SUSE HPE Helion OpenStack 8 xorg-x11-server 7.6_1.18.3-76.40.1 SUSE-SU-2021:1187-1
SUSE Enterprise Storage 6 xorg-x11-server 1.20.3-14.5.16.1 SUSE-SU-2021:1188-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed xorg-x11-server 1.20.13-1.2 openSUSE-SU-2024:11525-1
openSUSE Tumbleweed xwayland 21.1.2-2.1 openSUSE-SU-2024:11528-1
openSUSE Leap 15.2 xorg-x11-server 1.20.3-lp152.8.21.1 openSUSE-SU-2021:0554-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 xorg-server 1.20.10-r5 —
Alpine v3.24 xwayland 21.1.0-r4 —
Alpine v3.23 xorg-server 1.20.10-r5 —
Alpine v3.23 xwayland 21.1.0-r4 —
Alpine v3.22 xorg-server 1.20.10-r5 —
Alpine v3.22 xwayland 21.1.0-r4 —
Alpine v3.21 xorg-server 1.20.10-r5 —
Alpine v3.21 xwayland 21.1.0-r4 —
Alpine v3.20 xorg-server 1.20.10-r5 —
Alpine v3.20 xwayland 21.1.0-r4 —
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 xorg-server 1.20.10-r5 —
Alpine v3.19 xwayland 21.1.0-r4 —
Alpine v3.18 xorg-server 1.20.10-r5 —
Alpine v3.18 xwayland 21.1.0-r4 —
Alpine v3.17 xorg-server 1.20.10-r5 —
Alpine v3.17 xwayland 21.1.0-r4 —
Alpine v3.16 xorg-server 1.20.10-r5 —
Alpine v3.16 xwayland 21.1.0-r4 —
Alpine v3.15 xorg-server 1.20.10-r5 —
Alpine v3.15 xwayland 21.1.0-r4 —
Alpine v3.14 xorg-server 1.20.10-r5 —
Alpine v3.14 xwayland 21.1.0-r4 —
Alpine v3.13 xorg-server 1.20.10-r1 —
Alpine v3.12 xorg-server 1.20.10-r1 —
Alpine v3.11 xorg-server 1.20.6-r3 —
Alpine v3.10 xorg-server 1.20.5-r3 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 xorg-x11-server-Xdmx +8 1.20.4-15.amzn2.0.2 ALAS2-2021-1633

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 xorg-x11-server No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 xorg-x11-server-Xdmx +8 1.20.4-16.el7_9 ELSA-2021-2033

Advisories 17

References