Unscored severity · published Jun 16, 2008
CVE-2008-1377
The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuthorization function in the Security…
–
CVSS
2.7%
EPSS
No
On KEV
Description
The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuthorization function in the Security extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via requests with crafted length values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.7% · higher than 86% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
X1
X11 · X
r7.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-1377
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-1377
h20000.www2.hp.com
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01543321
labs.idefense.com
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=721
lists.apple.com
http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
lists.freedesktop.org
http://lists.freedesktop.org/archives/xorg/2008-June/036026.html
Patch
http://lists.opensuse.org/opensuse-security-announce/2008-06/msg00002.html
More from X11
–
CVE-2011-0465
xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a (1) DHCP or…
–
CVE-2008-1379
Integer overflow in the fbShmPutImage function in the MIT-SHM extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to read arbitrary process memory…
–
CVE-2008-2360
Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via…
–
CVE-2008-2362
Multiple integer overflows in the Render extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via a (1)…