Buffer overflow in libXxf86dga - CVE-2013-2000
Published: June 15, 2013 / Updated: August 3, 2020
Vulnerability identifier: #VU33309
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-2000
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Multiple buffer overflows in X.org libXxf86dga 1.1.3 and earlier allow X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the (1) XDGAQueryModes and (2) XDGASetMode functions.
Affected software
libXxf86dga
Amazon Linux AMI
Ubuntu
libxxf86dga (Alpine package)
libxxf86dga1 (Ubuntu package)
Amazon Linux AMI
Ubuntu
libxxf86dga (Alpine package)
libxxf86dga1 (Ubuntu package)
How to mitigate CVE-2013-2000
Install update from vendor's website.
libXxf86dga - update to 1.1.4
libxxf86dga (Alpine package) - addressed in versions 1.1.3-r1, 1.1.3-r2
libxxf86dga1 (Ubuntu package) - addressed in versions 2:1.1.2-1ubuntu0.1, 2:1.1.3-2ubuntu0.12.10.1, 2:1.1.3-2ubuntu0.13.04.1
libxxf86dga (Alpine package) - addressed in versions 1.1.3-r1, 1.1.3-r2
libxxf86dga1 (Ubuntu package) - addressed in versions 2:1.1.2-1ubuntu0.1, 2:1.1.3-2ubuntu0.12.10.1, 2:1.1.3-2ubuntu0.13.04.1