Detections
Analytics
GLSA-201704-03 : X.Org: Multiple vulnerabilities
critical Nessus Plugin ID 99276
Language:
Synopsis
The remote Gentoo host is missing one or more security-related patches.Description
The remote host is affected by the vulnerability described in GLSA-201704-03 (X.Org: Multiple vulnerabilities)Multiple vulnerabilities have been discovered in X.Org server and libraries. Please review the CVE identifiers referenced below for details.
Impact :
A local or remote users can utilize the vulnerabilities to attach to the X.Org session as a user and execute arbitrary code.
Workaround :
There is no known workaround at this time.
Solution
All X.Org-server users should upgrade to the latest version:# emerge --sync # emerge --ask --oneshot --verbose '>=x11-base/xorg-server-1.19.2' All libICE users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=x11-libs/libICE-1.0.9-r1' All libXdmcp users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=x11-libs/libXdmcp-1.1.2-r1' All libXrender users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=x11-libs/libXrender-0.9.10' All libXi users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=x11-libs/libXi-1.7.7' All libXrandr users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=x11-libs/libXrandr-1.5.1' All libXfixes users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=x11-libs/libXfixes-5.0.3' All libXv users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=x11-libs/libXv-1.0.11'
See Also
Plugin Details
Severity: Critical
ID: 99276
File Name: gentoo_GLSA-201704-03.nasl
Version: 3.4
Type: local
Family: Gentoo Local Security Checks
Published: 4/11/2017
Updated: 1/11/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: High
Base Score: 7.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: p-cpe:/a:gentoo:linux:libice, p-cpe:/a:gentoo:linux:libxdmcp, p-cpe:/a:gentoo:linux:libxfixes, p-cpe:/a:gentoo:linux:libxi, p-cpe:/a:gentoo:linux:libxrandr, p-cpe:/a:gentoo:linux:libxrender, p-cpe:/a:gentoo:linux:libxv, p-cpe:/a:gentoo:linux:xorg-server, cpe:/o:gentoo:linux
Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list
Patch Publication Date: 4/10/2017
Vulnerability Publication Date: 12/13/2016
Reference Information
CVE: CVE-2016-5407, CVE-2016-7942, CVE-2016-7943, CVE-2016-7944, CVE-2016-7945, CVE-2016-7946, CVE-2016-7947, CVE-2016-7948, CVE-2016-7949, CVE-2016-7950, CVE-2016-7953, CVE-2017-2624, CVE-2017-2625, CVE-2017-2626
GLSA: 201704-03