The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6721-1 advisory.

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31080)

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31081)

  - A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap()     function. This issue occurs when byte-swapped length values are used in replies, potentially leading to     memory leakage and segmentation faults, particularly when triggered by a client with a different     endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory     values and then transmit them back to the client until encountering an unmapped page, resulting in a     crash. Despite the attacker's inability to control the specific memory copied into the replies, the small     length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds     reads. (CVE-2024-31082)

  - The X.Org project reports: The ProcXIGetSelectedEvents() function uses the byte-swapped     length of the return data for the amount of data to return to               the client, if the client has     a different endianness than               the X server. The ProcXIPassiveGrabDevice() function uses the     byte-swapped             length of the return data for the amount of data to return to             the     client, if the client has a different endianness than             the X server. The ProcRenderAddGlyphs()     function calls the AllocateGlyph()             function to store new glyphs sent by the client to the X     server.             AllocateGlyph() would return a new glyph with refcount=0 and             a re-used     glyph would end up not changing the refcount at all.             The resulting glyph_new array would thus     have multiple entries             pointing to the same non-refcounted glyphs.
    ProcRenderAddGlyphs() may free a glyph, resulting in a             use-after-free when the same glyph     pointer is then later used. (CVE-2024-31083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 23.10 : X.Org X Server vulnerabilities (USN-6721-1)

high Nessus Plugin ID 192938

Version 1.1

Version 1.0

Version 1.1 Apr 8, 2024, 2:16 PM CVSS metrics ("CVSSv3 score" set to 7.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H") CVSSv3 score source (changed from "CVE-2024-31082" to none) Plugin Feed: 202404081416
Version 1.0 Apr 5, 2024, 10:46 AM New Plugin Feed: 202404051046