Vulnerability Details : CVE-2015-3164
The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket.
Products affected by CVE-2015-3164
- cpe:2.3:a:x.org:xorg-server:1.16.1:*:*:*:*:*:*:*
- cpe:2.3:a:x.org:xorg-server:1.16.1.901:*:*:*:*:*:*:*
- cpe:2.3:a:x.org:xorg-server:1.16.2:*:*:*:*:*:*:*
- cpe:2.3:a:x.org:xorg-server:1.16.2.901:*:*:*:*:*:*:*
- cpe:2.3:a:x.org:xorg-server:1.16.0:*:*:*:*:*:*:*
- cpe:2.3:a:x.org:xorg-server:1.17.0:*:*:*:*:*:*:*
- cpe:2.3:a:x.org:xorg-server:1.16.3:*:*:*:*:*:*:*
- cpe:2.3:a:x.org:xorg-server:1.16.4:*:*:*:*:*:*:*
- cpe:2.3:a:x.org:xorg-server:1.17.1:*:*:*:*:*:*:*
- cpe:2.3:a:x.org:xorg-server:1.16.99.901:*:*:*:*:*:*:*
- cpe:2.3:a:x.org:xorg-server:1.16.99.902:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-3164
0.16%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 33 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-3164
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
3.6
|
LOW | AV:L/AC:L/Au:N/C:P/I:P/A:N |
3.9
|
4.9
|
NIST |
CWE ids for CVE-2015-3164
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-3164
-
http://lists.freedesktop.org/archives/wayland-devel/2015-June/022548.html
X.Org/Wayland Security Advisory: Missing authentication in XWaylandVendor Advisory
-
http://lists.opensuse.org/opensuse-updates/2015-06/msg00044.html
openSUSE-SU-2015:1095-1: moderate: Security update for XWayland
-
https://security.gentoo.org/glsa/201701-64
X.Org X Server: Multiple vulnerabilities (GLSA 201701-64) — Gentoo security
-
http://www.securityfocus.com/bid/75535
X.Org X Server CVE-2015-3164 Authentication Bypass Vulnerability
Jump to