Information Exposure Affecting xorg-server package, versions <2:1.19.2-1


low

Snyk CVSS

    Attack Complexity High
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    EPSS 0.15% (51st percentile)
Expand this section
NVD
7 high
Expand this section
Red Hat
5.9 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-DEBIAN9-XORGSERVER-327011
  • published 27 Jun 2018
  • disclosed 27 Jul 2018

How to fix?

Upgrade Debian:9 xorg-server to version 2:1.19.2-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xorg-server package and not the xorg-server package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.