Off-by-one error in Xlib - CVE-2018-14599

Vulnerability identifier: #VU14503

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-14599

CWE-ID: CWE-193

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an off-by-one memory write error in the XGetFontPath(), XListExtensions(), and XListFonts() functions. A remote unauthenticated attacker can cause a remote X server to return a specially crafted response to trigger memory corruption and execute arbitrary code on the target X client.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Xlib
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Slackware Linux
Opensuse
Fedora
libx11 (Alpine package)
libX11
Dynamic System Analysis (DSA) Preboot
Flex System Chassis Management Module (CMM)

Install update from vendor's website.

libx11 (Alpine package) - update to 1.6.6-r0
Dynamic System Analysis (DSA) Preboot - update to dsyte2z-9.65
libX11 - update to 1.6.7-1.fc28
Flex System Chassis Management Module (CMM) - update to 2pet18a-2.5.14a

• https://gitlab.freedesktop.org/xorg/lib/libx11/commit/b469da1430cdcee06e31c6251b83aede072a1ff0

• Multiple vulnerabilities in X.org libX11
• Slackware Linux update for libX11
• OpenSUSE Linux update for libX11
• OpenSUSE Linux update for libX11
• Gentoo update for X.Org X11 library
• Red Hat update for Xorg
• Off-by-one error in libx11 (Alpine package)
• Multiple vulnerabilities in IBM Dynamic System Analysis (DSA) Preboot
• Multiple vulnerabilities in IBM Flex System Chassis Management Module (CMM)
• Fedora 28 update for libX11