CVE-2014-8093

Name of the Vulnerable Software and Affected Versions xorg-x11-server-Xdmx version 1.15.0 xorg-x11-server-debuginfo versions 1.1.1 through 1.15.0 xorg-x11-server-Xnest version 1.15.0 xorg-x11-server-Xephyr version 1.15.0 xorg-x11-server-source version 1.15.0 xorg-x11-server-Xvfb version 1.15.0 xorg-x11-server-common version 1.15.0 xorg-x11-server-Xvnc-source version 1.1.1 xorg-x11-server-devel version 1.15.0 xorg-x11-server-Xorg version 1.15.0 X.Org Server versions prior to 1.16.3

Description The issue involves multiple integer overflows in the GLX extension, which can lead to a denial of service or possibly execute arbitrary code via crafted requests to various functions, including glXDisp ReadPixels, glXDispSwap ReadPixels, glXDisp GetTexImage, glXDispSwap GetTexImage, GetSeparableFilter, GetConvolutionFilter, GetHistogram, GetMinmax, GetColorTable, glXGetAnswerBuffer, GLX GET ANSWER BUFFER, glXMap1dReqSize, glXMap1fReqSize, Map2Size, glXMap2dReqSize, glXMap2fReqSize, glXImageSize, or glXSeparableFilter2DReqSize. This can be exploited by remote authenticated users, potentially disrupting confidentiality, integrity, and availability of protected information.

Recommendations For xorg-x11-server-Xdmx version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-debuginfo versions 1.1.1 through 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xnest version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xephyr version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-source version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xvfb version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-common version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xvnc-source version 1.1.1, update to a version later than 1.1.1. For xorg-x11-server-devel version 1.15.0, update to a version later than 1.15.0. For xorg-x11-server-Xorg version 1.15.0, update to a version later than 1.15.0. For X.Org Server versions prior to 1.16.3, update to version 1.16.3 or later. As a temporary workaround, consider restricting access to the GLX extension until a patch is available.