A format string vulnerability in X.Org X Server may allow local privilege escalation or Denial of Service.
Package | x11-base/xorg-server on all architectures |
---|---|
Affected versions | < 1.11.4-r1 |
Unaffected versions | >= 1.11.4-r1 revision >= 1.10.6-r1 revision <= 1.9.5-r1 |
The X Window System is a graphical windowing system based on a client/server model.
The "LogVHdrMessageVerb()" function in log.c contains a format string vulnerability.
NOTE: Exposure to this vulnerability is reduced in Gentoo due to X.Org X Server being built with "-D_FORTIFY_SOURCE=2" by default.
A local attacker could gain escalated privileges or cause a Denial of Service condition.
There is no known workaround at this time.
All X.Org X Server 1.11.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.11.4-r1"
All X.Org X Server 1.10.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.10.6-r1"
X.Org X Server 1.9.x is not affected.
Release date
July 09, 2012
Latest revision
July 09, 2012: 1
Severity
high
Exploitable
local
Bugzilla entries