Input validation error in libXxf86dga - CVE-2013-1991
Published: June 15, 2013 / Updated: August 4, 2020
Vulnerability identifier: #VU33887
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-1991
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Multiple integer overflows in X.org libXxf86dga 1.1.3 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XDGAQueryModes and (2) XDGASetMode functions.
Affected software
libXxf86dga
Amazon Linux AMI
libxxf86dga (Alpine package)
Amazon Linux AMI
libxxf86dga (Alpine package)
How to mitigate CVE-2013-1991
Install update from vendor's website.
libXxf86dga - update to 1.1.4
libxxf86dga (Alpine package) - addressed in versions 1.1.3-r1, 1.1.3-r2
libxxf86dga (Alpine package) - addressed in versions 1.1.3-r1, 1.1.3-r2