Input validation error in libXxf86dga - CVE-2013-1991
Published: June 15, 2013 / Updated: August 4, 2020
Vulnerability identifier: #VU33887
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-1991
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to read and manipulate data.
Multiple integer overflows in X.org libXxf86dga 1.1.3 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XDGAQueryModes and (2) XDGASetMode functions.
Affected software
libXxf86dga
Amazon Linux AMI
Ubuntu
libxxf86dga (Alpine package)
libxxf86dga1 (Ubuntu package)
Amazon Linux AMI
Ubuntu
libxxf86dga (Alpine package)
libxxf86dga1 (Ubuntu package)
How to mitigate CVE-2013-1991
Install update from vendor's website.
libXxf86dga - update to 1.1.4
libxxf86dga (Alpine package) - addressed in versions 1.1.3-r1, 1.1.3-r2
libxxf86dga1 (Ubuntu package) - addressed in versions 2:1.1.2-1ubuntu0.1, 2:1.1.3-2ubuntu0.12.10.1, 2:1.1.3-2ubuntu0.13.04.1
libxxf86dga (Alpine package) - addressed in versions 1.1.3-r1, 1.1.3-r2
libxxf86dga1 (Ubuntu package) - addressed in versions 2:1.1.2-1ubuntu0.1, 2:1.1.3-2ubuntu0.12.10.1, 2:1.1.3-2ubuntu0.13.04.1
External References
Related Security Bulletins
- Input validation error in freedesktop libXxf86dga
- Input validation error in libxxf86dga (Alpine package)
- Amazon Linux AMI update for libX11, libXcursor, libXfixes, libXi, libXrandr, libXrender, libXres, libXt, libXv, libXvMC, libXxf86dga, libXxf86vm, libdmx, xorg-x11-proto-devel
- Ubuntu update for libxxf86dga