Amazon Linux 2 : libX11 (ALAS-2019-1226)

critical Nessus Plugin ID 125898

Language:

Synopsis

The remote Amazon Linux 2 host is missing a security update.

Description

An off-by-one error has been discovered in libX11 in functions XGetFontPath(), XListExtensions(), and XListFonts(). An attacker who can either configure a malicious X server or modify the data coming from one could use this flaw to make the program crash or have other unspecified effects, caused by the memory corruption. (CVE-2018-14599)

It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions() and XGetFontPath() functions to produce an invalid list of elements that in turn make XFreeExtensionsList() and XFreeFontPath() access invalid memory. An attacker who can either configure a malicious X server or modify the data coming from one, could use this flaw to crash the application using libX11, resulting in a denial of service. (CVE-2018-14598)

Solution

Run 'yum update libX11' to update your system.

Plugin Details

Severity: Critical

ID: 125898

File Name: al2_ALAS-2019-1226.nasl

Version: 1.3

Type: local

Agent: unix

Family: Amazon Linux Local Security Checks

Published: 6/14/2019

Updated: 5/16/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2018-14599

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:libx11-debuginfo, p-cpe:/a:amazon:linux:libx11, p-cpe:/a:amazon:linux:libx11-common, cpe:/o:amazon:linux:2, p-cpe:/a:amazon:linux:libx11-devel

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 6/13/2019

Vulnerability Publication Date: 8/24/2018

Reference Information

CVE: CVE-2018-14598, CVE-2018-14599

ALAS: 2019-1226

Detections

Analytics