CVE-2013-1998

X.org libXi < 1.7.1 - Buffer Overflow in XGetDeviceButtonMapping, XIPassiveGrabDevice, and XQueryDeviceState

Title source: llm
STIX 2.1

Description

Multiple buffer overflows in X.org libXi 1.7.1 and earlier allow X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the (1) XGetDeviceButtonMapping, (2) XIPassiveGrabDevice, and (3) XQueryDeviceState functions.

References (7)

Core 7
Core References
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1859-1
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106913.html
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2013-06/msg00161.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/60127
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2013/05/23/3
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2683

Scores

EPSS 0.0280
EPSS Percentile 84.8%

Details

CWE
CWE-119
Status published
Products (9)
x.org/libxi 1.5.0
x.org/libxi 1.5.99.2
x.org/libxi 1.5.99.3
x.org/libxi 1.6.0
x.org/libxi 1.6.1
x.org/libxi 1.6.2
x.org/libxi 1.6.99.1
x.org/libxi 1.7
x.org/libxi < 1.7.1
Published Jun 15, 2013
Tracked Since Feb 18, 2026