The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1199-1 advisory.

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31080)

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31081)

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31082)

  - A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue     occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially     resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently,     ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer     is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the     system by sending a specially crafted request. (CVE-2024-31083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES12 Security Update : xorg-x11-server (SUSE-SU-2024:1199-1)

high Nessus Plugin ID 193178

Version 1.0