CVE-2013-2004 The (1) GetDatabase and (2) _XimParseStringFile functions in X.org libX11 1.5.99.901 (1.6 RC1) and earlier do not restrict the recursion depth when processing directives to include files, which allows...
MediumCVSS 6.8
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) GetDatabase and (2) _XimParseStringFile functions in X.org libX11 1.5.99.901 (1.6 RC1) and earlier do not restrict the recursion depth when processing directives to include files, which allows X servers to cause a denial of service (stack consumption) via a crafted file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libx11(Debian:12) | < 2:1.5.0-1+deb7u1 | 2:1.5.0-1+deb7u1 |
| debian/libx11(Debian:13) | < 2:1.5.0-1+deb7u1 | 2:1.5.0-1+deb7u1 |
| debian/libx11(Debian:14) | < 2:1.5.0-1+deb7u1 | 2:1.5.0-1+deb7u1 |
| x libx11 | <= 1.5.99.901 | No fix listed |
| x libx11 | = 1.5.0 | No fix listed |
References
- Debian Security Tracker CVE-2013-2004 vendor-advisory
- DSA-2693 vendor-advisory
- [oss-security] 20130523 Fwd: [ANNOUNCE] X.Org Security Advisory: Protocol handling issues in X Window System client libraries mailing-list
- USN-1854-1 vendor-advisory
- www.x.org vendor-advisory