SB2017111024 - Fedora 25 update for nx-libs, x2goserver
Published: November 10, 2017 Updated: April 24, 2025
Security Bulletin ID
SB2017111024
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2017-2624)
The vulnerability allows a local authenticated user to execute arbitrary code.
It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.
Remediation
Install update from vendor's website.