Medium severity · published Aug 5, 2020
CVE-2020-14344
An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10
6.7
CVSS
0.5%
EPSS
No
On KEV
Description
An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FE
Fedora · Fedoraproject
31; 32; 33 · source: NVD
LE
Leap · Opensuse
15.1; 15.2 · source: NVD
LI
Libx11 · X.org
before 1.6.10 · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04; 16.04; 18.04; 20.04 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14344
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14344
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00014.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00015.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00024.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00031.html
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14344
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4VDDSAYV7XGNRCXE7HCU23645MG74OFF/
More from Ubuntu Linux
9.8
CVE-2020-11651
SaltStack Salt Authentication Bypass Vulnerability
9.8
CVE-2020-7247
OpenSMTPD Remote Code Execution Vulnerability
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2019-16928
Exim Out-of-bounds Write Vulnerability
9.8
CVE-2019-10149
Exim Mail Transfer Agent (MTA) Improper Input Validation