CVE-2017-12186
xorg-x11-server: unvalidated lengths in X-Resource extension
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (media), Ubuntu (media).
Descripción
xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.10 | xorg-server | 1.19.5-r0 |
| alpine 3.11 | xorg-server | 1.19.5-r0 |
| alpine 3.12 | xorg-server | 1.19.5-r0 |
| alpine 3.13 | xorg-server | 1.19.5-r0 |
| alpine 3.14 | xorg-server | 1.19.5-r0 |
| alpine 3.15 | xorg-server | 1.19.5-r0 |
| alpine 3.16 | xorg-server | 1.19.5-r0 |
| alpine 3.17 | xorg-server | 1.19.5-r0 |
| alpine 3.18 | xorg-server | 1.19.5-r0 |
| alpine 3.19 | xorg-server | 1.19.5-r0 |
| alpine 3.20 | xorg-server | 1.19.5-r0 |
| alpine 3.21 | xorg-server | 1.19.5-r0 |
Mostrar las 47 entradas de 35 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.10 | xorg-server | 1.19.5-r0 |
| alpine 3.11 | xorg-server | 1.19.5-r0 |
| alpine 3.12 | xorg-server | 1.19.5-r0 |
| alpine 3.13 | xorg-server | 1.19.5-r0 |
| alpine 3.14 | xorg-server | 1.19.5-r0 |
| alpine 3.15 | xorg-server | 1.19.5-r0 |
| alpine 3.16 | xorg-server | 1.19.5-r0 |
| alpine 3.17 | xorg-server | 1.19.5-r0 |
| alpine 3.18 | xorg-server | 1.19.5-r0 |
| alpine 3.19 | xorg-server | 1.19.5-r0 |
| alpine 3.20 | xorg-server | 1.19.5-r0 |
| alpine 3.21 | xorg-server | 1.19.5-r0 |
| alpine 3.22 | xorg-server | 1.19.5-r0 |
| alpine 3.23 | xorg-server | 1.19.5-r0 |
| alpine 3.24 | xorg-server | 1.19.5-r0 |
| alpine 3.6 | xorg-server | 1.19.5-r0 |
| alpine 3.7 | xorg-server | 1.19.5-r0 |
| alpine 3.8 | xorg-server | 1.19.5-r0 |
| alpine 3.9 | xorg-server | 1.19.5-r0 |
| alpine edge | xorg-server | 1.19.5-r0 |
| debian 11 | xorg-server | 2:1.19.5-1 |
| debian 12 | xorg-server | 2:1.19.5-1 |
| debian 13 | xorg-server | 2:1.19.5-1 |
| debian 14 | xorg-server | 2:1.19.5-1 |
| debian 8 | xorg-server | 2:1.16.4-1+deb8u2 |
| debian 9 | xorg-server | 2:1.19.2-1+deb9u2 |
| echo | xorg-server | 2:1.19.5-1 |
| Red Hat | xorg-x11-server | sin corrección indicada |
| Red Hat | xorg-x11-server-Xdmx | sin corrección indicada |
| Red Hat | xorg-x11-server-Xephyr | sin corrección indicada |
| Red Hat | xorg-x11-server-Xnest | sin corrección indicada |
| Red Hat | xorg-x11-server-Xorg | sin corrección indicada |
| Red Hat | xorg-x11-server-Xvfb | sin corrección indicada |
| Red Hat | xorg-x11-server-Xwayland | sin corrección indicada |
| Red Hat | xorg-x11-server-common | sin corrección indicada |
| Red Hat | xorg-x11-server-devel | sin corrección indicada |
| Red Hat | xorg-x11-server-source | sin corrección indicada |
| root.io debian 11 | rootio-xorg-server | 2:1.19.5-1 |
| root.io debian 12 | rootio-xorg-server | 2:1.19.5-1 |
| ubuntu 14.04 | xorg-server | 2:1.15.1-0ubuntu2.11 |
| ubuntu 14.04 | xorg-server-lts-xenial | 2:1.18.3-1ubuntu2.3~trusty4 |
| ubuntu 14.04-ESM | xorg-server | 2:1.15.1-0ubuntu2.11 |
| ubuntu 16.04 | xorg-server | 2:1.18.4-0ubuntu0.7 |
| ubuntu 16.04 | xorg-server-hwe-16.04 | 2:1.19.3-1ubuntu1~16.04.4 |
| ubuntu 16.04-ESM | xorg-server | 2:1.18.4-0ubuntu0.7 |
| ubuntu 16.04-ESM | xorg-server-hwe-16.04 | 2:1.19.3-1ubuntu1~16.04.4 |
| ubuntu 17.04 | xorg-server | 2:1.19.3-1ubuntu1.3 |
Referencias
- https://access.redhat.com/security/cve/CVE-2017-12186
- https://bugzilla.redhat.com/show_bug.cgi?id=1509216
- https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e
- https://lists.x.org/archives/xorg-announce/2017-October/002814.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-12186
- https://ubuntu.com/security/notices/USN-3456-1
- https://www.cve.org/CVERecord?id=CVE-2017-12186
- https://www.debian.org/security/2017/dsa-4000