Huawei EulerOS: Security Advisory for xorg-x11-server (EulerOS-SA-2019-2421)

Published: 2020-01-23 12:54:21
CVE Author: NIST National Vulnerability Database (NVD)

CVSS Base Vector:
AV:N/AC:L/Au:N/C:P/I:P/A:P

Summary:
The remote host is missing an update for the Huawei EulerOS 'xorg-x11-server' Linux Distribution Package(s) announced via the EulerOS-SA-2019-2421 advisory.

Detection Method:
Checks if a vulnerable Linux Distribution Package version is present on the target host.

Technical Details:
xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.(CVE-2017-12177) xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.(CVE-2017-12178) xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to cause X server to crash or possibly execute arbitrary code.(CVE-2017-12179) xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.(CVE-2017-12180) xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.(CVE-2017-12181) xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.(CVE-2017-12182) xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.(CVE-2017-12183) xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.(CVE-2017-12184) xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.(CVE-2017-12185) xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.(CVE-2017-12186) xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.(CVE-2017-12187) In X.Org Server (aka xserver and xorg-server) before 1.19.4, an attacker authenticated to an X server with the X shared memory extension enabled can cause aborts of the X server or replace shared memory segments of other X clients in the same session.(CVE-2017-13721) It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the ... Description truncated. Please see the references for more information.

Affected Versions:
'xorg-x11-server' Linux Distribution Package(s) on Huawei EulerOS V2.0SP2.

Recommendations:
Please install the updated Linux Distribution Package(s).

Solution Type:
Vendor Patch

Detection Type:
Linux Distribution Package

NIST (National Institute of Standards and Technology) NVD (National Vulnerability Database)

https://nvd.nist.gov/vuln/detail/CVE-2017-10971
https://nvd.nist.gov/vuln/detail/CVE-2017-10972
https://nvd.nist.gov/vuln/detail/CVE-2017-12176
https://nvd.nist.gov/vuln/detail/CVE-2017-12177
https://nvd.nist.gov/vuln/detail/CVE-2017-12178
https://nvd.nist.gov/vuln/detail/CVE-2017-12179
https://nvd.nist.gov/vuln/detail/CVE-2017-12180
https://nvd.nist.gov/vuln/detail/CVE-2017-12181
https://nvd.nist.gov/vuln/detail/CVE-2017-12182
https://nvd.nist.gov/vuln/detail/CVE-2017-12183
https://nvd.nist.gov/vuln/detail/CVE-2017-12184
https://nvd.nist.gov/vuln/detail/CVE-2017-12185
https://nvd.nist.gov/vuln/detail/CVE-2017-12186
https://nvd.nist.gov/vuln/detail/CVE-2017-12187
https://nvd.nist.gov/vuln/detail/CVE-2017-13721
https://nvd.nist.gov/vuln/detail/CVE-2017-2624
https://nvd.nist.gov/vuln/detail/CVE-2018-14665

References:

https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2019-2421

Search
Severity
High
CVSS Score
7.5

You never have to pay for a vulnerability scanning and management software again.

Tired of paying a subscription 'per asset' or 'per IP'? Well you can officially cancel your current subscription. Mageni provides a free, open source and enterprise-ready vulnerability scanning and management platform which helps you to find, prioritize, remediate and manage your vulnerabilities. It is free and always will be.