X.org X server 1.13.3 and earlier, when not run as root, allows local users to cause a denial of service (crash) or possibly gain privileges via vectors involving cached xkb files.

The remote host is affected by the vulnerability described in GLSA-201405-07 (X.Org X Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in X.Org X Server. Please       review the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

Pedro Ribeiro discovered that the X.Org X server incorrectly handled memory operations when handling ImageText requests. An attacker could use this issue to cause X.Org to crash, or to possibly execute arbitrary code. (CVE-2013-4396)

It was discovered that non-root X.Org X servers such as Xephyr incorrectly used cached xkb files. A local attacker could use this flaw to cause a xkb cache file to be loaded by another user, resulting in a denial of service. (CVE-2013-1056).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74028	GLSA-201405-07 : X.Org X Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
70492	Ubuntu 12.04 LTS / 12.10 / 13.04 : xorg-server, xorg-server-lts-quantal, xorg-server-lts-raring vulnerabilities (USN-1990-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2013-1056

high

Tenable Plugins

medium

medium