Vulnerability · Published Aug 5, 2020 · Assigned by redhat
CVE-2020-14344
Medium 6.7
In plain English
A medium-severity integer overflow in libX11 from The X11 Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | libglvnd | 1:1.3.2-1.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | libglvnd-core-devel | 1:1.3.2-1.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | libglvnd-devel | 1:1.3.2-1.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | libglvnd-egl | 1:1.3.2-1.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | libglvnd-gles | 1:1.3.2-1.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | libglvnd-glx | 1:1.3.2-1.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | libglvnd-opengl | 1:1.3.2-1.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | libinput-devel | 1.16.3-1.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | libwacom-devel | 1.6-2.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | mesa-libOSMesa-devel | 20.3.3-2.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | mesa-libgbm-devel | 20.3.3-2.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | xorg-x11-drivers | 7.7-30.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | xorg-x11-server-devel | 1.20.10-1.el8 | ALSA-2021:1804 |
| AlmaLinux:8 | xorg-x11-server-source | 1.20.10-1.el8 | ALSA-2021:1804 |
| Alpine:v3.20 | libx11 | 1.6.10-r0 | ALPINE-CVE-2020-14344 |
| Alpine:v3.21 | libx11 | 1.6.10-r0 | ALPINE-CVE-2020-14344 |
| Alpine:v3.22 | libx11 | 1.6.10-r0 | ALPINE-CVE-2020-14344 |
| Alpine:v3.23 | libx11 | 1.6.10-r0 | ALPINE-CVE-2020-14344 |
| Alpine:v3.24 | libx11 | 1.6.10-r0 | ALPINE-CVE-2020-14344 |
| Debian:12 | libx11 | 2:1.6.10-1 | DEBIAN-CVE-2020-14344 |
| Debian:13 | libx11 | 2:1.6.10-1 | DEBIAN-CVE-2020-14344 |
| Debian:14 | libx11 | 2:1.6.10-1 | DEBIAN-CVE-2020-14344 |
| Rocky Linux:8 | egl-wayland | 0:1.1.5-3.el8 | RLSA-2021:1804 |
| Rocky Linux:8 | libX11 | 0:1.6.8-4.el8 | RLSA-2021:1804 |
| Rocky Linux:8 | libdrm | 0:2.4.103-1.el8 | RLSA-2021:1804 |
| Rocky Linux:8 | libglvnd | 1:1.3.2-1.el8 | RLSA-2021:1804 |
| Rocky Linux:8 | libinput | 0:1.16.3-1.el8 | RLSA-2021:1804 |
| Rocky Linux:8 | libwacom | 0:1.6-2.el8 | RLSA-2021:1804 |
| Rocky Linux:8 | mesa | 0:20.3.3-2.el8 | RLSA-2021:1804 |
| Rocky Linux:8 | xorg-x11-drivers | 0:7.7-30.el8 | RLSA-2021:1804 |
| Rocky Linux:8 | xorg-x11-server | 0:1.20.10-1.el8 | RLSA-2021:1804 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| The X11 Project | libX11 | 1.6.10 |
Weakness: CWE-190 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://lists.x.org/archives/xorg-announce/2020-July/003050.html x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2020/07/31/1 x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14344 x_refsource_CONFIRM
- openSUSE-SU-2020:1162 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1164 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1182 vendor-advisory, x_refsource_SUSE
- openSUSE-SU-2020:1198 vendor-advisory, x_refsource_SUSE
- FEDORA-2020-eba554b9d5 vendor-advisory, x_refsource_FEDORA
- GLSA-202008-18 vendor-advisory, x_refsource_GENTOO
- USN-4487-1 vendor-advisory, x_refsource_UBUNTU
- FEDORA-2020-9a0b272cc1 vendor-advisory, x_refsource_FEDORA
- USN-4487-2 vendor-advisory, x_refsource_UBUNTU
- FEDORA-2020-cf0afbd27e vendor-advisory, x_refsource_FEDORA