Vulnerability Description
The Render extension in XFree86 4.0.1, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) ProcRenderQueryVersion, (2) SProcRenderQueryVersion, (3) SProcRenderQueryPictFormats, (4) SProcRenderQueryPictIndexValues, (5) SProcRenderCreatePicture, (6) SProcRenderChangePicture, (7) SProcRenderSetPictureClipRectangles, (8) SProcRenderFreePicture, (9) SProcRenderComposite, (10) SProcRenderScale, (11) SProcRenderCreateGlyphSet, (12) SProcRenderReferenceGlyphSet, (13) SProcRenderFreeGlyphSet, (14) SProcRenderFreeGlyphs, or (15) SProcRenderCompositeGlyphs function.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| X.Org | Xfree86 | 4.0.1 |
| X.Org | X Server | <= 1.16.2.99.901 |
| X.Org | X11 | 6.7 |
Related Weaknesses (CWE)
References
- http://advisories.mageia.org/MGASA-2014-0532.html
- http://secunia.com/advisories/61947
- http://secunia.com/advisories/62292
- http://www.debian.org/security/2014/dsa-3095
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:119
- http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.securityfocus.com/bid/71602
- http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/PatchVendor Advisory
- https://security.gentoo.org/glsa/201504-06
- http://advisories.mageia.org/MGASA-2014-0532.html
- http://secunia.com/advisories/61947
- http://secunia.com/advisories/62292
- http://www.debian.org/security/2014/dsa-3095
FAQ
What is CVE-2014-8100?
CVE-2014-8100 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Render extension in XFree86 4.0.1, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of...
How severe is CVE-2014-8100?
CVE-2014-8100 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-8100?
Check the references section above for vendor advisories and patch information. Affected products include: X.Org Xfree86, X.Org X Server, X.Org X11.