Vulnerability identifier: #VU53336

Vulnerability risk: Low

CVSSv3.1:

CVE-ID: CVE-2021-31535

CWE-ID:

Exploitation vector: Local

Exploit availability:

Vulnerable software:
libx11
Other software / Other software solutions

Vendor: xorg.freedesktop.org

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of color names within the XLookupColor() function. A local user can run a specially crafted application on the system and perform a denial of service (DoS) attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

libx11: 1.0.99.1 - 1.7.0

---

Fixed software versions

CPE

• cpe:2.3:a:xorg.freedesktop.org:libx11:1.7.0:*:*:*:*:*:*:*

External links
http://seclists.org/oss-sec/2021/q2/153
http://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge-color-space/

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?