Vulnerability Details : CVE-2013-4396
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
Vulnerability category: Memory CorruptionExecute codeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2013-4396
Probability of exploitation activity in the next 30 days: 2.90%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 89 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2013-4396
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST |
CWE ids for CVE-2013-4396
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-4396
-
http://openwall.com/lists/oss-security/2013/10/08/6
oss-security - Fwd: X.Org security advisory: CVE-2013-4396: Use after free in Xserver handling of ImageText requests
-
http://www.securityfocus.com/bid/62892
X.Org X Server 'dixfonts.c' Use-After-Free Remote Memory Corruption Vulnerability
-
http://rhn.redhat.com/errata/RHSA-2013-1426.html
RHSA-2013:1426 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-updates/2013-10/msg00060.html
openSUSE-SU-2013:1614-1: moderate: update for xorg-x11-server
-
http://lists.opensuse.org/opensuse-updates/2013-10/msg00056.html
openSUSE-SU-2013:1610-1: moderate: update for xorg-x11-server
-
https://bugzilla.redhat.com/show_bug.cgi?id=1014561
1014561 – (CVE-2013-4396) CVE-2013-4396 xorg-x11-server: use-after-free flaw when handling ImageText requestsPatch
-
http://lists.x.org/archives/xorg-announce/2013-October/002332.html
X.Org security advisory: CVE-2013-4396: Use after free in Xserver handling of ImageText requestsVendor Advisory
-
http://www.debian.org/security/2013/dsa-2784
Debian -- Security Information -- DSA-2784-1 xorg-server
-
http://www.ubuntu.com/usn/USN-1990-1
USN-1990-1: X.Org X server vulnerabilities | Ubuntu security notices
Products affected by CVE-2013-4396
- cpe:2.3:a:x:x.org_x11:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:7.3:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:7.4:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:6.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:6.6:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:6.7:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:6.8:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:6.3:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:6.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:6.1:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:6.4:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:6.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:6.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:7.5:rc1:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:7.6:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:7.6:rc1:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:7.7:*:*:*:*:*:*:*
- cpe:2.3:a:x:x.org_x11:7.7:rc1:*:*:*:*:*:*