CVE-2013-1984
Public on 2013-06-15
Modified on 2014-11-24
Description
Multiple integer overflows in X.org libXi 1.7.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XGetDeviceControl, (2) XGetFeedbackControl, (3) XGetDeviceDontPropagateList, (4) XGetDeviceMotionEvents, (5) XIGetProperty, (6) XIGetSelectedEvents, (7) XGetDeviceProperties, and (8) XListInputDevices functions.
Severity
Medium
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 1 | libX11 | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libXcursor | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libXfixes | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libXi | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libXrandr | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libXrender | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libXres | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libXt | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libXv | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libXvMC | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libXxf86dga | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libXxf86vm | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | libdmx | 2014-11-22 | ALAS-2014-452 | Fixed |
| Amazon Linux 1 | xorg-x11-proto-devel | 2014-11-22 | ALAS-2014-452 | Fixed |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv2 | 4.3 | AV:A/AC:H/Au:N/C:P/I:P/A:P |
| NVD | CVSSv2 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |