CVE-2014-8100

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-8100
The Render extension in XFree86 4.0.1, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) ProcRenderQueryVersion, (2) SProcRenderQueryVersion, (3) SProcRenderQueryPictFormats, (4) SProcRenderQueryPictIndexValues, (5) SProcRenderCreatePicture, (6) SProcRenderChangePicture, (7) SProcRenderSetPictureClipRectangles, (8) SProcRenderFreePicture, (9) SProcRenderComposite, (10) SProcRenderScale, (11) SProcRenderCreateGlyphSet, (12) SProcRenderReferenceGlyphSet, (13) SProcRenderFreeGlyphSet, (14) SProcRenderFreeGlyphs, or (15) SProcRenderCompositeGlyphs function.

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://advisories.mageia.org/MGASA-2014-0532.html
http://secunia.com/advisories/61947
http://secunia.com/advisories/62292
http://www.debian.org/security/2014/dsa-3095
http://www.mandriva.com/security/advisories?name=MDVSA-2015:119
http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
http://www.securityfocus.com/bid/71602
http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/ Patch Vendor Advisory
https://security.gentoo.org/glsa/201504-06
Configurations

Configuration 1 (hide)

cpe:2.3:a:x.org:xfree86:4.0.1:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:x.org:xorg-server:*:*:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:x.org:x11:6.7:*:*:*:*:*:*:*
History

13 Feb 2023, 00:42

Type Values Removed Values Added
Summary Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server. The Render extension in XFree86 4.0.1, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) ProcRenderQueryVersion, (2) SProcRenderQueryVersion, (3) SProcRenderQueryPictFormats, (4) SProcRenderQueryPictIndexValues, (5) SProcRenderCreatePicture, (6) SProcRenderChangePicture, (7) SProcRenderSetPictureClipRectangles, (8) SProcRenderFreePicture, (9) SProcRenderComposite, (10) SProcRenderScale, (11) SProcRenderCreateGlyphSet, (12) SProcRenderReferenceGlyphSet, (13) SProcRenderFreeGlyphSet, (14) SProcRenderFreeGlyphs, or (15) SProcRenderCompositeGlyphs function.
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1168711', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1168711', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:1983', 'name': 'https://access.redhat.com/errata/RHSA-2014:1983', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-8100', 'name': 'https://access.redhat.com/security/cve/CVE-2014-8100', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:1982', 'name': 'https://access.redhat.com/errata/RHSA-2014:1982', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:19

Type Values Removed Values Added
Summary The Render extension in XFree86 4.0.1, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) ProcRenderQueryVersion, (2) SProcRenderQueryVersion, (3) SProcRenderQueryPictFormats, (4) SProcRenderQueryPictIndexValues, (5) SProcRenderCreatePicture, (6) SProcRenderChangePicture, (7) SProcRenderSetPictureClipRectangles, (8) SProcRenderFreePicture, (9) SProcRenderComposite, (10) SProcRenderScale, (11) SProcRenderCreateGlyphSet, (12) SProcRenderReferenceGlyphSet, (13) SProcRenderFreeGlyphSet, (14) SProcRenderFreeGlyphs, or (15) SProcRenderCompositeGlyphs function. Multiple out-of-bounds access flaws were found in the way the X.Org server calculated memory requirements for certain requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server.
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1168711 -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:1983 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-8100 -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:1982 -
Information

Published : 2014-12-10 15:59

Updated : 2023-12-10 11:31

NVD link : CVE-2014-8100

Mitre link : CVE-2014-8100

CVE.ORG link : CVE-2014-8100

JSON object : View

Products Affected

x.org

  • xorg-server
  • xfree86
  • x11
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer