Multiple off-by-one errors in the (1) MakeBigReq and (2) SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11 before 1.6.0 allow remote attackers to have unspecified impact via a crafted request, which triggers a buffer overflow.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libX11: Out of Bounds write in XListExtensions in ListExt.c (CVE-2018-14600)

  - Multiple integer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to trigger     allocation of insufficient memory and a buffer overflow via vectors related to the (1) XQueryFont, (2)
    _XF86BigfontQueryFont, (3) XListFontsWithInfo, (4) XGetMotionEvents, (5) XListHosts, (6)     XGetModifierMapping, (7) XGetPointerMapping, (8) XGetKeyboardMapping, (9) XGetWindowProperty, (10)     XGetImage, (11) LoadColornameDB, (12) XrmGetFileDatabase, (13) _XimParseStringFile, or (14) TransFileName     functions. (CVE-2013-1981)

  - Multiple buffer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to cause a     denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the     (1) XAllocColorCells, (2) _XkbReadGetDeviceInfoReply, (3) _XkbReadGeomShapes, (4)
    _XkbReadGetGeometryReply, (5) _XkbReadKeySyms, (6) _XkbReadKeyActions, (7) _XkbReadKeyBehaviors, (8)
    _XkbReadModifierMap, (9) _XkbReadExplicitComponents, (10) _XkbReadVirtualModMap, (11)
    _XkbReadGetNamesReply, (12) _XkbReadGetMapReply, (13) _XimXGetReadData, (14) XListFonts, (15)     XListExtensions, and (16) XGetFontPath functions. (CVE-2013-1997)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

xorg-x11-libX11 was updated to fix one security issue.

This security issue was fixed :

  - CVE-2013-7439: Multiple off-by-one errors in the (1)     MakeBigReq and (2) SetReqLen macros in     include/X11/Xlibint.h in X11R6.x and libX11 before 1.6.0     allowed remote attackers to have unspecified impact via     a crafted request, which triggered a buffer overflow     (bsc#927220).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Abhishek Arya discovered a buffer overflow in the MakeBigReq macro provided by libx11, which could result in denial of service or the execution of arbitrary code.

Several other xorg packages (e.g. libxrender) will be recompiled against the fixed package after the release of this update. For detailed information on the status of recompiled packages please refer to the Debian Security Tracker at https://security-tracker.debian.org/tracker/CVE-2013-7439

For the oldstable distribution (squeeze), this problem has been fixed in version 2:1.3.3-4+squeeze2.

For the stable distribution (wheezy), this problem has been fixed in version 2:1.5.0-1+deb7u2.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2568-1 advisory.

    Abhishek Arya discovered that libX11 incorrectly handled memory in the MakeBigReq macro. A remote attacker     could use this issue to cause applications to crash, resulting in a denial of service, or possibly execute     arbitrary code.

    In addition, following the macro fix in libx11, a number of other packages have also been rebuilt as     security updates including libxrender, libxext, libxi, libxfixes, libxrandr, libsdl1.2, libxv, libxp, and     xserver-xorg-video-vmware.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Abhishek Arya discovered a buffer overflow in the MakeBigReq macro provided by libx11, which could result in denial of service or the execution of arbitrary code.

Several other xorg packages (e.g. libxrender) will be recompiled against the fixed package after the release of this update. For detailed information on the status of recompiled packages please refer to the Debian Security Tracker at https://security-tracker.debian.org/tracker/CVE-2013-7439.

ID	Name	Product	Family	Severity
198680	RHEL 5 : libx11 (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
85215	SUSE SLED11 / SLES11 Security Update : xorg-x11-libX11 (SUSE-SU-2015:1334-1)	Nessus	SuSE Local Security Checks	high
82785	Debian DLA-199-1 : libx11 security update	Nessus	Debian Local Security Checks	high
82766	Ubuntu 14.04 LTS : libx11, libxrender vulnerability (USN-2568-1)	Nessus	Ubuntu Local Security Checks	critical
82746	Debian DSA-3224-1 : libx11 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2013-7439

critical

Tenable Plugins

critical

high

high

critical

high