X.Org Server (aka xserver and xorg-server) 1.15.0 through 1.16.x before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) sproc_dri3_query_version, (2) sproc_dri3_open, (3) sproc_dri3_pixmap_from_buffer, (4) sproc_dri3_buffer_from_pixmap, (5) sproc_dri3_fence_from_fd, (6) sproc_dri3_fd_from_fence, (7) proc_present_query_capabilities, (8) sproc_present_query_version, (9) sproc_present_pixmap, (10) sproc_present_notify_msc, (11) sproc_present_select_input, or (12) sproc_present_query_capabilities function in the (a) DRI3 or (b) Present extension.

The remote host is affected by the vulnerability described in GLSA-201504-06 (X.Org X Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in X.Org X Server. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This X.Org update fixes the following security issues :

  - denial of service due to unchecked malloc in client     authentication (CVE-2014-8091)

  - integer overflows calculating memory needs for requests:
    CVE-2014-8092: X11 core protocol requests CVE-2014-8093:
    GLX extension CVE-2014-8094: DRI2 extension

  - out of bounds access due to not validating length or     offset values in requests: CVE-2014-8095: XInput     extension CVE-2014-8096: XC-MISC extension     CVE-2014-8097: DBE extension CVE-2014-8098: GLX     extension CVE-2014-8099: XVideo extension CVE-2014-8100:
    Render extension CVE-2014-8101: RandR extension     CVE-2014-8102: XFixes extension CVE-2014-8103: DRI3 and     Present extensions

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple integer overflow flaws and out-of-bounds write flaws were found in the way the X.Org server calculated memory requirements for certain X11 core protocol and GLX extension requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges. (CVE-2014-8092 , CVE-2014-8093 , CVE-2014-8098)

It was found that the X.Org server did not properly handle SUN-DES-1 (Secure RPC) authentication credentials. A malicious, unauthenticated client could use this flaw to crash the X.Org server by submitting a specially crafted authentication request. (CVE-2014-8091)

Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server, or leak memory contents to the client.
(CVE-2014-8097)

An integer overflow flaw was found in the way the X.Org server calculated memory requirements for certain DRI2 extension requests. A malicious, authenticated client could use this flaw to crash the X.Org server. (CVE-2014-8094)

Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server. (CVE-2014-8095 , CVE-2014-8096 , CVE-2014-8099 , CVE-2014-8100 , CVE-2014-8101 , CVE-2014-8102 , CVE-2014-8103)

This X.Org update fixes the following security and non security issues :

  - Add and update security patches. (bnc#907268,     CVE-2014-8091, CVE-2014-8092, CVE-2014-8093,     CVE-2014-8094, CVE-2014-8095, CVE-2014-8096,     CVE-2014-8097, CVE-2014-8098, CVE-2014-8099,     CVE-2014-8100, CVE-2014-8101, CVE-2014-8102,     CVE-2014-8103)     http://lists.x.org/archives/xorg-announce/2014-December/     002501.html

  - Fixes rendering of some icewm and xfwm themes.
    (bnc#908258, bnc#856931)

New xorg-server packages are available for Slackware 14.1 and
-current to fix security issues.

Multiple integer overflow flaws and out-of-bounds write flaws were found in the way the X.Org server calculated memory requirements for certain X11 core protocol and GLX extension requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges. (CVE-2014-8092, CVE-2014-8093, CVE-2014-8098)

It was found that the X.Org server did not properly handle SUN-DES-1 (Secure RPC) authentication credentials. A malicious, unauthenticated client could use this flaw to crash the X.Org server by submitting a specially crafted authentication request. (CVE-2014-8091)

Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server, or leak memory contents to the client.
(CVE-2014-8097)

An integer overflow flaw was found in the way the X.Org server calculated memory requirements for certain DRI2 extension requests. A malicious, authenticated client could use this flaw to crash the X.Org server. (CVE-2014-8094)

Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server. (CVE-2014-8095, CVE-2014-8096, CVE-2014-8099, CVE-2014-8100, CVE-2014-8101, CVE-2014-8102, CVE-2014-8103)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1983 advisory.

    X.Org is an open source implementation of the X Window System. It provides     the basic low-level functionality that full-fledged graphical user     interfaces are designed upon.

    Multiple integer overflow flaws and out-of-bounds write flaws were found in     the way the X.Org server calculated memory requirements for certain X11     core protocol and GLX extension requests. A malicious, authenticated client     could use either of these flaws to crash the X.Org server or, potentially,     execute arbitrary code with root privileges. (CVE-2014-8092, CVE-2014-8093,     CVE-2014-8098)

    It was found that the X.Org server did not properly handle SUN-DES-1     (Secure RPC) authentication credentials. A malicious, unauthenticated     client could use this flaw to crash the X.Org server by submitting a     specially crafted authentication request. (CVE-2014-8091)

    Multiple out-of-bounds access flaws were found in the way the X.Org server     calculated memory requirements for certain requests. A malicious,     authenticated client could use either of these flaws to crash the X.Org     server, or leak memory contents to the client. (CVE-2014-8097)

    An integer overflow flaw was found in the way the X.Org server calculated     memory requirements for certain DRI2 extension requests. A malicious,     authenticated client could use this flaw to crash the X.Org server.
    (CVE-2014-8094)

    Multiple out-of-bounds access flaws were found in the way the X.Org server     calculated memory requirements for certain requests. A malicious,     authenticated client could use either of these flaws to crash the X.Org     server. (CVE-2014-8095, CVE-2014-8096, CVE-2014-8099, CVE-2014-8100,     CVE-2014-8101, CVE-2014-8102, CVE-2014-8103)

    All xorg-x11-server users are advised to upgrade to these updated packages,     which contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1983 advisory.

    [1.15.0-7.0.1.el7_0.3]
    - Invalid BUG_RETURN_VAL fix, upstream patch (orabug 18896390)

    [1.15.0-7.3]
    - CVE fixes for: CVE-2014-8099, CVE-2014-8098, CVE-2014-8097, CVE-2014-8096,       CVE-2014-8095, CVE-2014-8094, CVE-2014-8093, CVE-2014-8092, CVE-2014-8091,       CVE-2014-8101, CVE-2014-8100, CVE-2014-8103, CVE-2014-8102

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated xorg-x11-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Multiple integer overflow flaws and out-of-bounds write flaws were found in the way the X.Org server calculated memory requirements for certain X11 core protocol and GLX extension requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges. (CVE-2014-8092, CVE-2014-8093, CVE-2014-8098)

It was found that the X.Org server did not properly handle SUN-DES-1 (Secure RPC) authentication credentials. A malicious, unauthenticated client could use this flaw to crash the X.Org server by submitting a specially crafted authentication request. (CVE-2014-8091)

Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server, or leak memory contents to the client.
(CVE-2014-8097)

An integer overflow flaw was found in the way the X.Org server calculated memory requirements for certain DRI2 extension requests. A malicious, authenticated client could use this flaw to crash the X.Org server. (CVE-2014-8094)

Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server. (CVE-2014-8095, CVE-2014-8096, CVE-2014-8099, CVE-2014-8100, CVE-2014-8101, CVE-2014-8102, CVE-2014-8103)

All xorg-x11-server users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2436-1 advisory.

    Ilja van Sprundel discovered a multitude of security issues in the X.Org X server. An attacker able to     connect to an X server, either locally or remotely, could use these issues to cause the X server to crash     or execute arbitrary code resulting in possible privilege escalation.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
84071	GLSA-201504-06 : X.Org X Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	medium
83664	SUSE SLED12 / SLES12 Security Update : xorg-x11-server (SUSE-SU-2015:0047-1)	Nessus	SuSE Local Security Checks	Local	medium
80557	Amazon Linux AMI : xorg-x11-server (ALAS-2015-470)	Nessus	Amazon Linux Local Security Checks	Local	medium
80275	openSUSE Security Update : xorg-x11-server (openSUSE-SU-2014:1719-1)	Nessus	SuSE Local Security Checks	Local	medium
80206	Slackware 14.1 / current : xorg-server (SSA:2014-356-03)	Nessus	Slackware Local Security Checks	Local	medium
80018	Scientific Linux Security Update : xorg-x11-server on SL6.x, SL7.x i386/x86_64 (20141211)	Nessus	Scientific Linux Local Security Checks	Local	medium
80011	RHEL 6 / 7 : xorg-x11-server (RHSA-2014:1983)	Nessus	Red Hat Local Security Checks	Local	high
80001	Oracle Linux 6 / 7 : xorg-x11-server (ELSA-2014-1983)	Nessus	Oracle Linux Local Security Checks	Local	critical
79879	CentOS 6 / 7 : xorg-x11-server (CESA-2014:1983)	Nessus	CentOS Local Security Checks	Local	medium
79852	Ubuntu 14.04 LTS : X.Org X server vulnerabilities (USN-2436-1)	Nessus	Ubuntu Local Security Checks	Local	critical

Detections

Analytics

CVE-2014-8103

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

critical

medium

critical