CVE-2013-1992

Impact:
Moderate
Public Date:
2013-05-23
Bugzilla:
959074: CVE-2013-1992 libdmx: Multiple integer overflows leading to heap-based bufer overflows

The MITRE CVE dictionary describes this issue as:

Multiple integer overflows in X.org libdmx 1.1.2 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) DMXGetScreenAttributes, (2) DMXGetWindowAttributes, and (3) DMXGetInputAttributes functions.

Find out more about CVE-2013-1992 from the MITRE CVE dictionary dictionary and NIST NVD.

Statement

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This flaw only affects X clients that connect to malicious X servers. Generally speaking, these will be untrusted/unknown X servers only, as trusted remote X servers should be connected to via SSH (which provides end-point verification and authentication), or the local X server. Because this flaw requires that the X server be changed (recompiled to deviate from a standard X server) in order to impact the X client, it requires root privileges on the X server to effect the change. If this is a system where the X client and server are on the same (local) host, and an attacker is able to replace the X server binary, then they already have root privileges and no trust boundary is crossed. With remote X servers, using SSH with strict host-key checking will prevent the X client from connecting to the X server without intervention, as the user will be alerted to host-key changes.

CVSS v2 metrics

Base Score 4.3
Base Metrics AV:A/AC:H/Au:N/C:P/I:P/A:P
Access Vector Adjacent Network
Access Complexity High
Authentication None
Confidentiality Impact Partial
Integrity Impact Partial
Availability Impact Partial

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux 6 (libdmx) RHSA-2014:1436 2014-10-13

Affected Packages State

Platform Package State
Red Hat Enterprise Linux 5 libdmx Will not fix

External References

Last Modified

CVE description copyright © 2017, The MITRE Corporation