{
  "threat_severity" : "Important",
  "public_date" : "2018-10-25T14:00:00Z",
  "bugzilla" : {
    "description" : "xorg-x11-server: Incorrect permission check in Xorg X server allows for privilege escalation",
    "id" : "1637761",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1637761"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.6",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-271",
  "details" : [ "A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.", "An incorrect permission check for -modulepath and -logfile options when starting Xorg X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges." ],
  "statement" : "This issue did not affect the versions of xorg-x11-server as shipped with Red Hat Enterprise Linux 5 and 6, as well as Red Hat Enterprise Linux 7 prior to 7.4, as they did not allow the use of vulnerable command line options when running with elevated privileges.\nThe default X server configuration in Red Hat Enterprise Linux only allows users logged in on the system's physical console to run Xorg X server. Therefore, users which only have remote access to the the system (for example using SSH) can not exploit this flaw.",
  "acknowledgement" : "Red Hat would like to thank Narendra Shinde for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2018-10-30T00:00:00Z",
    "advisory" : "RHSA-2018:3410",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "xorg-x11-server-0:1.20.1-5.1.el7"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Not affected",
    "package_name" : "xorg-x11-server",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "xorg-x11-server",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "xorg-x11-server",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2018-14665\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-14665\nhttps://lists.x.org/archives/xorg-announce/2018-October/002927.html" ],
  "name" : "CVE-2018-14665",
  "csaw" : false
}