Detections
Analytics

Alpine: multiple libx11 packages: security update to 1.7.1-r0

critical Tenable Cloud Security Plugin ID 424115

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute
 arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw
 allowing a client to send color-name requests with a name longer than the maximum size allowed by the
 protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data
 exceeding the maximum size is then interpreted by the server as additional X protocol requests and
 executed, e.g., to disable X server authorization completely. For example, if the victim encounters
 malicious terminal control sequences for color codes, then the attacker may be able to take full control
 of the running graphical session. (CVE-2021-31535)

See Also

https://security.alpinelinux.org/vuln/CVE-2021-31535

Plugin Details

Severity: Critical

ID: 424115

Version: Revision 1.8

Type: Local

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-31535

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 5/27/2021

Reference Information

CVE: CVE-2021-31535