Detections
Analytics
Debian DLA-1482-1 : libx11 security update
critical Nessus Plugin ID 112184
Language:
Synopsis
The remote Debian host is missing a security update.Description
Several issues were discovered in libx11, the client interface to the X Windows System. The functions XGetFontPath, XListExtensions, and XListFonts are vulnerable to an off-by-one override on malicious server responses. A malicious server could also send a reply in which the first string overflows, causing a variable set to NULL that will be freed later on, leading to a segmentation fault and Denial of Service. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to a Denial of Service or possibly remote code execution.For Debian 8 'Jessie', these problems have been fixed in version 2:1.6.2-3+deb8u2.
We recommend that you upgrade your libx11 packages.
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Upgrade the affected packages.See Also
https://lists.debian.org/debian-lts-announce/2018/08/msg00030.html
Plugin Details
Severity: Critical
ID: 112184
File Name: debian_DLA-1482.nasl
Version: 1.5
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 8/30/2018
Updated: 8/13/2024
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2018-14600
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:libx11-6, p-cpe:/a:debian:debian_linux:libx11-6-dbg, p-cpe:/a:debian:debian_linux:libx11-data, p-cpe:/a:debian:debian_linux:libx11-doc, p-cpe:/a:debian:debian_linux:libx11-xcb-dev, p-cpe:/a:debian:debian_linux:libx11-xcb1, p-cpe:/a:debian:debian_linux:libx11-6-udeb, cpe:/o:debian:debian_linux:8.0, p-cpe:/a:debian:debian_linux:libx11-dev, p-cpe:/a:debian:debian_linux:libx11-xcb1-dbg
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 8/29/2018