Login Request a demo
Unscored severity · published Jul 3, 2012
CVE-2011-4029
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a…
–
CVSS
0.6%
EPSS
No
On KEV
Description
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XS
X Server · X.org
through 1.11.1; 1.11.0 · source: NVD
Affected product
XS
X Server
X.org
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4029
Patch
http://cgit.freedesktop.org/xorg/xserver/commit/?id=b67581cf825940fdf52bf2e0af4330e695d724a4
lists.freedesktop.org
http://lists.freedesktop.org/archives/xorg/2011-October/053680.html
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2012-0939.html
Vendor Advisory
http://secunia.com/advisories/46460
Vendor Advisory
http://secunia.com/advisories/49579
More from X Server
9.8
CVE-2023-6816
A flaw was found in X.Org server
9.8
CVE-2017-12187
xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code
9.8
CVE-2017-12186
xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code
9.8
CVE-2017-12185
xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code
9.8
CVE-2017-12184
xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code