MGASA-2015-0073

    Dashboard / Vulnerabilities / MGASA-2015-0073

    MGASA-2015-0073

    Published: 17 Feb 2015Last Modified: 16 Apr 2026
    Upstream:
    CVE-2015-0255

    Summary: Updated x11-server packages fix CVE-2015-0255

    Details: Updated x11-server packages fix security vulnerability: Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request, where the server trusts the client to send valid string lengths. A malicious client with string lengths exceeding the request length can cause the server to copy adjacent memory data into the XKB structs. This data is then available to the client via the XkbGetGeometry request. This can lead to information disclosure issues, as well as possibly a denial of service if a similar request can cause the server to crash (CVE-2015-0255).

    References: https://advisories.mageia.org/MGASA-2015-0073.html, https://bugs.mageia.org/show_bug.cgi?id=15265, http://www.x.org/wiki/Development/Security/Advisory-2015-02-10/

    Affected packages

    Package

    Name: x11-server

    Purl: pkg:rpm/mageia/x11-server?arch=source&distro=mageia-4

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.14.5-2.3.mga4

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    MGASA-2015-0073 | CVE-DB