The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - x11perfcomp has dot in its path (CVE-2011-2504)

  - The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the     existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently     if the file exists. (CVE-2011-4028)

  - The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the     permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed     execution permission) via a symlink attack on a temporary lock file. (CVE-2011-4029)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Solaris system is missing necessary patches to address security updates :

  - The LockServer function in os/utils.c in X.Org xserver     before 1.11.2 allows local users to determine the     existence of arbitrary files via a symlink attack on a     temporary lock file, which is handled differently if the     file exists. (CVE-2011-4028)

  - The LockServer function in os/utils.c in X.Org xserver     before 1.11.2 allows local users to change the     permissions of arbitrary files to 444, read those files,     and possibly cause a denial of service (removed     execution permission) via a symlink attack on a     temporary lock file. (CVE-2011-4029)

The X server had two security issues and one bug that is fixed by this update.

CVE-2011-4028: It is possible for a local attacker to deduce if a file exists or not by exploiting the way that Xorg creates its lock files.

CVE-2011-4029: It is possible for a non-root local user to set the read permission for all users on any file or directory.

A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack. (CVE-2011-4028)

A race condition was found in the way the X.Org server managed temporary lock files. A local attacker could use this flaw to perform a symbolic link attack, allowing them to make an arbitrary file world readable, leading to the disclosure of sensitive information.
(CVE-2011-4029)

From Red Hat Security Advisory 2012:0939 :

Updated xorg-x11-server packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack. (CVE-2011-4028)

A race condition was found in the way the X.Org server managed temporary lock files. A local attacker could use this flaw to perform a symbolic link attack, allowing them to make an arbitrary file world readable, leading to the disclosure of sensitive information.
(CVE-2011-4029)

Red Hat would like to thank the researcher with the nickname vladz for reporting these issues.

This update also fixes the following bugs :

* Prior to this update, the KDE Display Manager (KDM) could pass invalid 24bpp pixmap formats to the X server. As a consequence, the X server could unexpectedly abort. This update modifies the underlying code to pass the correct formats. (BZ#651934, BZ#722860)

* Prior to this update, absolute input devices, like the stylus of a graphic tablet, could become unresponsive in the right-most or bottom-most screen if the X server was configured as a multi-screen setup through multiple 'Device' sections in the xorg.conf file. This update changes the screen crossing behavior so that absolute devices are always mapped across all screens. (BZ#732467)

* Prior to this update, the misleading message 'Session active, not inhibited, screen idle. If you see this test, your display server is broken and you should notify your distributor.' could be displayed after resuming the system or re-enabling the display, and included a URL to an external web page. This update removes this message.
(BZ#748704)

* Prior to this update, the erroneous input handling code of the Xephyr server disabled screens on a screen crossing event. The focus was only on the screen where the mouse was located and only this screen was updated when the Xephyr nested X server was configured in a multi-screen setup. This update removes this code and Xephyr now correctly updates screens in multi-screen setups. (BZ#757792)

* Prior to this update, raw events did not contain relative axis values. As a consequence, clients which relied on relative values for functioning did not behave as expected. This update sets the values to the original driver values instead of the already transformed values.
Now, raw events contain relative axis values as expected. (BZ#805377)

All users of xorg-x11-server are advised to upgrade to these updated packages, which correct these issues. All running X.Org server instances must be restarted for this update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2012-0303 advisory.

    [1.1.1-48.90.0.1.el5]
    - Added oracle-enterprise-detect.patch
    - Replaced 'Red Hat' in spec file

    [1.1.1-48.90]
    - cve-2011-4028.patch: File existence disclosure vulnerability.

    [1.1.1-48.88]
    - cve-2011-4818.patch: Multiple input sanitization flaws in Render and GLX
    - xorg-x11-server-1.1.0-mesa-copy-sub-buffer.patch: Likewise.

    [1.1.1-48.87]
    - xserver-1.1.1-fbdev-iterate-modes.patch: fix fbdev driver not iterating       across all modes of a certain dimension (#740497)

    [1.1.1-48.86]
    - xserver-1.1.1-midc-double-free.patch: Don't double-free the picture for       the root window when using the mi (software) cursor path. (#674741)

    [1.1.1-48.85]
    - xserver-1.1.1-bigreqs-buffer-size.patch: Fix BIG-REQUESTS buffer size       (#555000)

    [1.1.1-48.84]
    - xserver-1.1.1-xinerama-crash.patch: Fix a crash in XineramaQueryScreens       when client is swapped (#588346)

    [1.1.1-48.83]
    - xserver-1.1.1-xephyr-keymap.patch: Fix types in Xephyr keymap setup (#454409)

    [1.1.1-48.82]
    - xserver-1.1.1-wideline-overflow.patch: Fix integer overflow in wide line       renderer (#649810)

    [1.1.1-48.81]
    - Fix mouse stuck on edge (#529717)

    [1.1.1-48.80]
    - xserver-1.1.1-bs-crash.patch: Fix a crash in backing store. (#676270)

    [1.1.1-48.79]
    - xserver-1.1.1-randr-fix-mouse-crossing.patch: fix zaphod mouse crossing (#559964)

    [1.1.1-48.78]
    - cve-2010-1166.patch: Fix broken modulo math in Render and arc code.
      Identical to xserver-1.1.1-mod-macro-parens.patch in 5.5.z. (#582651)

    [1.1.1-48.77]
    - xserver-1.1.1-dbe-validate-gc.patch: Validate the GC against both front       and back buffers (#596899)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update of xorg-x11-server-rdp fixed the following security issues :

  - memory exhaustion flaw CVE-2011-4028 / CVE-2011-4029 -     race condition flaw. (CVE-2010-2240)

This update of xorg-x11-server-dmx fixed the following security issues :

  - memory exhaustion flaw CVE-2011-4028 / CVE-2011-4029 -     race condition flaw. (CVE-2010-2240)

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack. (CVE-2011-4028)

A race condition was found in the way the X.Org server managed temporary lock files. A local attacker could use this flaw to perform a symbolic link attack, allowing them to make an arbitrary file world readable, leading to the disclosure of sensitive information.
(CVE-2011-4029)

This update also fixes the following bugs :

  - Prior to this update, the KDE Display Manager (KDM)     could pass invalid 24bpp pixmap formats to the X server.
    As a consequence, the X server could unexpectedly abort.
    This update modifies the underlying code to pass the     correct formats.

  - Prior to this update, absolute input devices, like the     stylus of a graphic tablet, could become unresponsive in     the right-most or bottom-most screen if the X server was     configured as a multi-screen setup through multiple     'Device' sections in the xorg.conf file. This update     changes the screen crossing behavior so that absolute     devices are always mapped across all screens.

  - Prior to this update, the misleading message 'Session     active, not inhibited, screen idle. If you see this     test, your display server is broken and you should     notify your distributor.' could be displayed after     resuming the system or re-enabling the display, and     included a URL to an external web page. This update     removes this message.

  - Prior to this update, the erroneous input handling code     of the Xephyr server disabled screens on a screen     crossing event. The focus was only on the screen where     the mouse was located and only this screen was updated     when the Xephyr nested X server was configured in a     multi-screen setup. This update removes this code and     Xephyr now correctly updates screens in multi-screen     setups.

  - Prior to this update, raw events did not contain     relative axis values. As a consequence, clients which     relied on relative values for functioning did not behave     as expected. This update sets the values to the original     driver values instead of the already transformed values.
    Now, raw events contain relative axis values as     expected.

All users of xorg-x11-server are advised to upgrade to these updated packages, which correct these issues. All running X.Org server instances must be restarted for this update to take effect.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack. (CVE-2011-4028)

This update also fixes the following bugs :

  - In rare cases, if the front and back buffer of the     miDbePositionWindow() function were not both allocated     in video memory, or were both allocated in system     memory, the X Window System sometimes terminated     unexpectedly. A patch has been provided to address this     issue and X no longer crashes in the described scenario.

  - Previously, when the miSetShape() function called the     miRegionDestroy() function with a NULL region, X     terminated unexpectedly if the backing store was     enabled. Now, X no longer crashes in the described     scenario.

  - On certain workstations running in 32-bit mode, the X11     mouse cursor occasionally became stuck near the left     edge of the X11 screen. A patch has been provided to     address this issue and the mouse cursor no longer     becomes stuck in the described scenario.

  - On certain workstations with a dual-head graphics     adapter using the r500 driver in Zaphod mode, the mouse     pointer was confined to one monitor screen and could not     move to the other screen. A patch has been provided to     address this issue and the mouse cursor works properly     across both screens.

  - Due to a double free operation, Xvfb (X virtual     framebuffer) terminated unexpectedly with a segmentation     fault randomly when the last client disconnected, that     is when the server reset. This bug has been fixed in the     miDCCloseScreen() function and Xvfb no longer crashes.

  - Starting the Xephyr server on an AMD64 or Intel 64     architecture with an integrated graphics adapter caused     the server to terminate unexpectedly. This bug has been     fixed in the code and Xephyr no longer crashes in the     described scenario.

  - Previously, when a client made a request bigger than     1/4th of the limit advertised in the BigRequestsEnable     reply, the X server closed the connection unexpectedly.
    With this update, the maxBigRequestSize variable has     been added to the code to check the size of client     requests, thus fixing this bug.

  - When an X client running on a big-endian system called     the XineramaQueryScreens() function, the X server     terminated unexpectedly. This bug has been fixed in the     xf86Xinerama module and the X server no longer crashes     in the described scenario.

  - When installing Scientific Linux 5 on an IBM eServer     System p blade server, the installer did not set the     correct mode on the built-in KVM (Keyboard-Video-Mouse).
    Consequently, the graphical installer took a very long     time to appear and then was displayed incorrectly. A     patch has been provided to address this issue and the     graphical installer now works as expected in the     described scenario. Note that this fix requires the     Scientific Linux 5.8 kernel update.

  - Lines longer than 46,340 pixels can be drawn with one of     the coordinates being negative. However, for dashed     lines, the miPolyBuildPoly() function overflowed the     'int' type when setting up edges for a section of a     dashed line. Consequently, dashed segments were not     drawn at all. An upstream patch has been applied to     address this issue and dashed lines are now drawn     correctly.

All users of xorg-x11-server are advised to upgrade to these updated packages, which correct these issues. All running X.Org server instances must be restarted for this update to take effect.

Updated xorg-x11-server packages that fix two security issues and several bugs are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having low security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack. (CVE-2011-4028)

A race condition was found in the way the X.Org server managed temporary lock files. A local attacker could use this flaw to perform a symbolic link attack, allowing them to make an arbitrary file world readable, leading to the disclosure of sensitive information.
(CVE-2011-4029)

Red Hat would like to thank the researcher with the nickname vladz for reporting these issues.

This update also fixes the following bugs :

* Prior to this update, the KDE Display Manager (KDM) could pass invalid 24bpp pixmap formats to the X server. As a consequence, the X server could unexpectedly abort. This update modifies the underlying code to pass the correct formats. (BZ#651934, BZ#722860)

* Prior to this update, absolute input devices, like the stylus of a graphic tablet, could become unresponsive in the right-most or bottom-most screen if the X server was configured as a multi-screen setup through multiple 'Device' sections in the xorg.conf file. This update changes the screen crossing behavior so that absolute devices are always mapped across all screens. (BZ#732467)

* Prior to this update, the misleading message 'Session active, not inhibited, screen idle. If you see this test, your display server is broken and you should notify your distributor.' could be displayed after resuming the system or re-enabling the display, and included a URL to an external web page. This update removes this message.
(BZ#748704)

* Prior to this update, the erroneous input handling code of the Xephyr server disabled screens on a screen crossing event. The focus was only on the screen where the mouse was located and only this screen was updated when the Xephyr nested X server was configured in a multi-screen setup. This update removes this code and Xephyr now correctly updates screens in multi-screen setups. (BZ#757792)

* Prior to this update, raw events did not contain relative axis values. As a consequence, clients which relied on relative values for functioning did not behave as expected. This update sets the values to the original driver values instead of the already transformed values.
Now, raw events contain relative axis values as expected. (BZ#805377)

All users of xorg-x11-server are advised to upgrade to these updated packages, which correct these issues. All running X.Org server instances must be restarted for this update to take effect.

Updated xorg-x11-server packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way the X.Org server handled lock files. A local user with access to the system console could use this flaw to determine the existence of a file in a directory not accessible to the user, via a symbolic link attack. (CVE-2011-4028)

Red Hat would like to thank the researcher with the nickname vladz for reporting this issue.

This update also fixes the following bugs :

* In rare cases, if the front and back buffer of the miDbePositionWindow() function were not both allocated in video memory, or were both allocated in system memory, the X Window System sometimes terminated unexpectedly. A patch has been provided to address this issue and X no longer crashes in the described scenario.
(BZ#596899)

* Previously, when the miSetShape() function called the miRegionDestroy() function with a NULL region, X terminated unexpectedly if the backing store was enabled. Now, X no longer crashes in the described scenario. (BZ#676270)

* On certain workstations running in 32-bit mode, the X11 mouse cursor occasionally became stuck near the left edge of the X11 screen. A patch has been provided to address this issue and the mouse cursor no longer becomes stuck in the described scenario. (BZ#529717)

* On certain workstations with a dual-head graphics adapter using the r500 driver in Zaphod mode, the mouse pointer was confined to one monitor screen and could not move to the other screen. A patch has been provided to address this issue and the mouse cursor works properly across both screens. (BZ#559964)

* Due to a double free operation, Xvfb (X virtual framebuffer) terminated unexpectedly with a segmentation fault randomly when the last client disconnected, that is when the server reset. This bug has been fixed in the miDCCloseScreen() function and Xvfb no longer crashes. (BZ#674741)

* Starting the Xephyr server on an AMD64 or Intel 64 architecture with an integrated graphics adapter caused the server to terminate unexpectedly. This bug has been fixed in the code and Xephyr no longer crashes in the described scenario. (BZ#454409)

* Previously, when a client made a request bigger than 1/4th of the limit advertised in the BigRequestsEnable reply, the X server closed the connection unexpectedly. With this update, the maxBigRequestSize variable has been added to the code to check the size of client requests, thus fixing this bug. (BZ#555000)

* When an X client running on a big-endian system called the XineramaQueryScreens() function, the X server terminated unexpectedly.
This bug has been fixed in the xf86Xinerama module and the X server no longer crashes in the described scenario. (BZ#588346)

* When installing Red Hat Enterprise Linux 5 on an IBM eServer System p blade server, the installer did not set the correct mode on the built-in KVM (Keyboard-Video-Mouse). Consequently, the graphical installer took a very long time to appear and then was displayed incorrectly. A patch has been provided to address this issue and the graphical installer now works as expected in the described scenario.
Note that this fix requires the Red Hat Enterprise Linux 5.8 kernel update. (BZ#740497)

* Lines longer than 46,340 pixels can be drawn with one of the coordinates being negative. However, for dashed lines, the miPolyBuildPoly() function overflowed the 'int' type when setting up edges for a section of a dashed line. Consequently, dashed segments were not drawn at all. An upstream patch has been applied to address this issue and dashed lines are now drawn correctly. (BZ#649810)

All users of xorg-x11-server are advised to upgrade to these updated packages, which correct these issues. All running X.Org server instances must be restarted for this update to take effect.

This update fixes two security issues with the X server :

  - A local attacker could find out if a file exists by     exploiting the way that Xorg creates its lock files.
    (CVE-2011-4028)

  - A non-root local user could set the read permission for     all users on any file or directory. (CVE-2011-4029)

The remote host is affected by the vulnerability described in GLSA-201110-19 (X.Org X Server: Multiple vulnerabilities)

    vladz reported the following vulnerabilities in the X.Org X server:
      The X.Org X server follows symbolic links when trying to access the         lock file for a X display, showing a predictable behavior depending on         the file type of the link target (CVE-2011-4028).
      The X.Org X server lock file mechanism allows for a race condition to         cause the X server to modify the file permissions of an arbitrary file         to 0444 (CVE-2011-4029).
  Impact :

    A local attacker could exploit these vulnerabilities to disclose       information by making arbitrary files on a system world-readable or gain       information whether a specified file exists on the system and whether it       is a file, directory, or a named pipe.
  Workaround :

    There is no known workaround at this time.

USN-1232-1 fixed vulnerabilities in the X.Org X server. A regression was found on Ubuntu 10.04 LTS that affected GLX support, and USN-1232-2 was released to temporarily disable the problematic security fix. This update includes a revised fix for CVE-2010-4818.

We apologize for the inconvenience.

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly execute arbitrary code with root privileges. This issue only affected Ubuntu 10.04 LTS and 10.10. (CVE-2010-4818)

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly read arbitrary data from the X server process. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-4819)

Vladz discovered that the X server incorrectly handled lock files. A local attacker could use this flaw to determine if a file existed or not. (CVE-2011-4028)

Vladz discovered that the X server incorrectly handled setting lock file permissions. A local attacker could use this flaw to gain read permissions on arbitrary files and view sensitive information. (CVE-2011-4029).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-1232-1 fixed vulnerabilities in the X.Org X server. A regression was found on Ubuntu 10.04 LTS that affected GLX support.

This update temporarily disables the fix for CVE-2010-4818 that introduced the regression.

We apologize for the inconvenience.

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly execute arbitrary code with root privileges. This issue only affected Ubuntu 10.04 LTS and 10.10. (CVE-2010-4818)

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly read arbitrary data from the X server process. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-4819)

Vladz discovered that the X server incorrectly handled lock files. A local attacker could use this flaw to determine if a file existed or not. (CVE-2011-4028)

Vladz discovered that the X server incorrectly handled setting lock file permissions. A local attacker could use this flaw to gain read permissions on arbitrary files and view sensitive information. (CVE-2011-4029).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly execute arbitrary code with root privileges. This issue only affected Ubuntu 10.04 LTS and 10.10. (CVE-2010-4818)

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly read arbitrary data from the X server process. This issue only affected Ubuntu 10.04 LTS. (CVE-2010-4819)

Vladz discovered that the X server incorrectly handled lock files. A local attacker could use this flaw to determine if a file existed or not. (CVE-2011-4028)

Vladz discovered that the X server incorrectly handled setting lock file permissions. A local attacker could use this flaw to gain read permissions on arbitrary files and view sensitive information.
(CVE-2011-4029).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matthieu Herrb reports :

It is possible to deduce if a file exists or not by exploiting the way that Xorg creates its lock files. This is caused by the fact that the X server is behaving differently if the lock file already exists as a symbolic link pointing to an existing or non-existing file.

It is possible for a non-root user to set the permissions for all users on any file or directory to 444, giving unwanted read access or causing denies of service (by removing execute permission). This is caused by a race between creating the lock file and setting its access modes.

ID	Name	Product	Family	Severity
198488	RHEL 4 : xorg-x11 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
80818	Oracle Solaris Third-Party Patch Update : xorg (cve_2011_4028_information_disclosure)	Nessus	Solaris Local Security Checks	low
75780	openSUSE Security Update : xorg-x11-Xvnc (openSUSE-SU-2012:0227-1)	Nessus	SuSE Local Security Checks	low
69594	Amazon Linux AMI : xorg-x11-server (ALAS-2012-104)	Nessus	Amazon Linux Local Security Checks	low
68561	Oracle Linux 6 : xorg-x11-server (ELSA-2012-0939)	Nessus	Oracle Linux Local Security Checks	low
68474	Oracle Linux 5 : xorg-x11-server (ELSA-2012-0303)	Nessus	Oracle Linux Local Security Checks	high
64240	SuSE 11.1 / 11.2 Security Update : xorg-x11-server-rdp (SAT Patch Numbers 6111 / 6113)	Nessus	SuSE Local Security Checks	high
64239	SuSE 11.1 Security Update : xorg-x11-server-dmx, xorg-x11-server-dmx-debuginfo, etc (SAT Patch Number 6112)	Nessus	SuSE Local Security Checks	high
61351	Scientific Linux Security Update : xorg-x11-server on SL6.x i386/x86_64 (20120620)	Nessus	Scientific Linux Local Security Checks	low
61274	Scientific Linux Security Update : xorg-x11-server on SL5.x i386/x86_64 (20120221)	Nessus	Scientific Linux Local Security Checks	low
59932	CentOS 6 : xorg-x11-server (CESA-2012:0939)	Nessus	CentOS Local Security Checks	low
59597	RHEL 6 : xorg-x11-server (RHSA-2012:0939)	Nessus	Red Hat Local Security Checks	low
58057	RHEL 5 : xorg-x11-server (RHSA-2012:0303)	Nessus	Red Hat Local Security Checks	low
57138	SuSE 11.1 Security Update : xorg-x11-server (SAT Patch Number 5479)	Nessus	SuSE Local Security Checks	low
56594	GLSA-201110-19 : X.Org X Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	low
56580	Ubuntu 10.04 LTS / 10.10 : xorg-server vulnerability (USN-1232-3)	Nessus	Ubuntu Local Security Checks	high
56563	Ubuntu 10.04 LTS : xorg-server regression (USN-1232-2)	Nessus	Ubuntu Local Security Checks	high
56555	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : xorg-server vulnerabilities (USN-1232-1)	Nessus	Ubuntu Local Security Checks	high
56548	FreeBSD : Xorg server -- two vulnerabilities in X server lock handling code (8441957c-f9b4-11e0-a78a-bcaec565249c)	Nessus	FreeBSD Local Security Checks	low

Detections

Analytics

CVE-2011-4028

high

Tenable Plugins

critical

low

low

low

low

high

high

high

low

low

low

low

low

low

low

high

high

high

low