CVE-2020-14344

MEDIUM

libX11 < 1.6.10 - Integer Overflow to Heap Buffer Overflow in XIM Client

Title source: llm
STIX 2.1

Description

An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.

References (13)

Core 13
Core References
Mailing List, Patch, Vendor Advisory x_refsource_misc
https://lists.x.org/archives/xorg-announce/2020-July/003050.html
Mailing List, Patch, Third Party Advisory x_refsource_misc
https://www.openwall.com/lists/oss-security/2020/07/31/1
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14344
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00014.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00015.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00024.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00031.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202008-18
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4487-1/
Third Party Advisory vendor-advisory x_refsource_ubuntu
https://usn.ubuntu.com/4487-2/

Scores

CVSS v3 6.7
EPSS 0.0016
EPSS Percentile 36.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-190
Status published
Products (11)
canonical/ubuntu_linux 12.04
canonical/ubuntu_linux 14.04
canonical/ubuntu_linux 16.04
canonical/ubuntu_linux 18.04
canonical/ubuntu_linux 20.04
fedoraproject/fedora 31
fedoraproject/fedora 32
fedoraproject/fedora 33
opensuse/leap 15.1
opensuse/leap 15.2
... and 1 more
Published Aug 05, 2020
Tracked Since Feb 18, 2026