Unscored severity · published Jul 3, 2012
CVE-2011-4028
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock…
–
CVSS
0.4%
EPSS
No
On KEV
Description
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XS
X Server · X.org
through 1.11.1; 1.11.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4028
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4028
cgit.freedesktop.org
http://cgit.freedesktop.org/xorg/xserver/commit/?id=6ba44b91e37622ef8c146d8f2ac92d708a18ed34
lists.freedesktop.org
http://lists.freedesktop.org/archives/xorg/2011-October/053680.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-0939.html
Vendor Advisory
http://secunia.com/advisories/46460
Vendor Advisory
http://secunia.com/advisories/49579
More from X Server
9.8
CVE-2023-6816
A flaw was found in X.Org server
9.8
CVE-2017-12187
xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code
9.8
CVE-2017-12186
xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code
9.8
CVE-2017-12185
xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code
9.8
CVE-2017-12184
xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code