CVE-2010-4818
published 2012-09-05CVE-2010-4818: The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via…
PriorityP345high8.5CVSS 2.0
AVNACMAuSCCICAC
EPSS
5.35%
91.7th percentile
The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value in the screen field in a request to glx/glxcmds.c.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xorg-server | < xorg-server 2:1.9.99.902-1 (bookworm) | xorg-server 2:1.9.99.902-1 (bookworm) |
| x.org | x.org | — | — |
| x.org | xorg-server | >= 0 < 2:1.9.99.902-1 | 2:1.9.99.902-1 |
| x.org | xorg-server | >= 0 < 2:1.9.99.902-1 | 2:1.9.99.902-1 |
| x.org | xorg-server | >= 0 < 2:1.9.99.902-1 | 2:1.9.99.902-1 |
| x.org | xorg-server | >= 0 < 2:1.9.99.902-1 | 2:1.9.99.902-1 |
CVSS provenance
nvdv2.08.5HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
osv8.5HIGH
vendor_debian8.5HIGH
vendor_redhat8.5HIGH
vendor_ubuntu8.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
X.Org X server vulnerability
vendor_ubuntu·2011-10-20·CVSS 8.5
CVE-2010-4818 [HIGH] X.Org X server vulnerability
Title: X.Org X server vulnerability
Summary: The X server could be made to crash or run programs as an administrator.
USN-1232-1 fixed vulnerabilities in the X.Org X server. A regression was
found on Ubuntu 10.04 LTS that affected GLX support, and USN-1232-2 was
released to temporarily disable the problematic security fix. This update
includes a revised fix for CVE-2010-4818.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the X server incorrectly handled certain malformed
input. An authorized attacker could exploit this to cause the X server to
crash, leading to a denial or service, or possibly execute arbitrary code
with root privileges. This issue only affected Ubuntu 10.04 LTS and 10.10.
(CVE-2010-4818)
It was discovered that the X server inc
Ubuntu
X.Org X server regression
vendor_ubuntu·2011-10-19·CVSS 8.5
CVE-2010-4818 [HIGH] X.Org X server regression
Title: X.Org X server regression
Summary: USN-1232-1 caused a regression with GLX support.
USN-1232-1 fixed vulnerabilities in the X.Org X server. A regression was
found on Ubuntu 10.04 LTS that affected GLX support.
This update temporarily disables the fix for CVE-2010-4818 that introduced
the regression.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the X server incorrectly handled certain malformed
input. An authorized attacker could exploit this to cause the X server to
crash, leading to a denial or service, or possibly execute arbitrary code
with root privileges. This issue only affected Ubuntu 10.04 LTS and 10.10.
(CVE-2010-4818)
It was discovered that the X server incorrectly handled certain malformed
input. An authorized attacker could
Ubuntu
X.Org X server vulnerabilities
vendor_ubuntu·2011-10-18·CVSS 8.5
CVE-2011-4029 [HIGH] X.Org X server vulnerabilities
Title: X.Org X server vulnerabilities
Summary: The X server could be made to crash, run programs as an administrator, or
read arbitrary files.
It was discovered that the X server incorrectly handled certain malformed
input. An authorized attacker could exploit this to cause the X server to
crash, leading to a denial or service, or possibly execute arbitrary code
with root privileges. This issue only affected Ubuntu 10.04 LTS and 10.10.
(CVE-2010-4818)
It was discovered that the X server incorrectly handled certain malformed
input. An authorized attacker could exploit this to cause the X server to
crash, leading to a denial or service, or possibly read arbitrary data from
the X server process. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-4819)
Vladz discovered that the X server
Red Hat
X.org: multiple GLX input sanitization flaws
vendor_redhat·2011-09-21·CVSS 8.5
CVE-2010-4818 [HIGH] X.org: multiple GLX input sanitization flaws
X.org: multiple GLX input sanitization flaws
The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value in the screen field in a request to glx/glxcmds.c.
Debian
CVE-2010-4818: xorg-server - The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to ca...
vendor_debian·2010·CVSS 8.5
CVE-2010-4818 [HIGH] CVE-2010-4818: xorg-server - The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to ca...
The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value in the screen field in a request to glx/glxcmds.c.
Scope: local
bookworm: resolved (fixed in 2:1.9.99.902-1)
bullseye: resolved (fixed in 2:1.9.99.902-1)
forky: resolved (fixed in 2:1.9.99.902-1)
sid: resolved (fixed in 2:1.9.99.902-1)
trixie: resolved (fixed in 2:1.9.99.902-1)
GHSA
GHSA-c8m7-2vm3-5fjq: The GLX extension in X
ghsa_unreviewed·2022-05-17
CVE-2010-4818 [HIGH] CWE-20 GHSA-c8m7-2vm3-5fjq: The GLX extension in X
The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value in the screen field in a request to glx/glxcmds.c.
OSV
CVE-2010-4818: The GLX extension in X
osv·2012-09-05·CVSS 8.5
CVE-2010-4818 [HIGH] CVE-2010-4818: The GLX extension in X
The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value in the screen field in a request to glx/glxcmds.c.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2010-4818 X.org: multiple GLX input sanitization flaws [fedora-14]
bugzilla·2011-10-06·CVSS 8.5
CVE-2010-4818 [HIGH] CVE-2010-4818 X.org: multiple GLX input sanitization flaws [fedora-14]
CVE-2010-4818 X.org: multiple GLX input sanitization flaws [fedora-14]
fedora-14 tracking bug for xorg-x11-server: see blocks bug list for full details of the security issue(s).
This bug is never intended to be made public, please put any public notes
in the 'blocks' bugs.
[bug automatically created by: add-tracking-bugs]
Discussion:
Closing, couldn't build for F14 if I wanted to.
Bugzilla
CVE-2010-4818 X.org: multiple GLX input sanitization flaws
bugzilla·2011-09-23·CVSS 8.5
CVE-2010-4818 [HIGH] CVE-2010-4818 X.org: multiple GLX input sanitization flaws
CVE-2010-4818 X.org: multiple GLX input sanitization flaws
It was reported [1] that a number of GLX X calls were lacking proper input sanitization. This could allow an attacker with access to the GLX calls to crash the X server or, possibly, execute arbitrary code within it (typically, this would just be the logged in user).
These were fixed in upstream git [2] with the following commits:
402b329c3aa8ddbebaa1f593306a02d4cd6fed26
1137c11be0f82049d28024eaf963c6f76e0d4334
a883cf1545abd89bb2cadfa659718884b56fd234
d9225b9602c85603ae616a7381c784f5cf5e811c
62319e8381ebd645ae36b25e5fc3c0e9b098387b
6c69235a9dfc52e4b4e47630ff4bab1a820eb543
ec9c97c6bf70b523bc500bd3adf62176f1bb33a4
3f0d3f4d97bce75c1828635c322b6560a45a037f
[1] https://bugs.freedesktop.org/show_bug.cgi?id=28823
[2] http://cgit.freed
http://cgit.freedesktop.org/xorg/xserver/commit?id=3f0d3f4d97bce75c1828635c322b6560a45a037fhttp://cgit.freedesktop.org/xorg/xserver/commit?id=6c69235a9dfc52e4b4e47630ff4bab1a820eb543http://cgit.freedesktop.org/xorg/xserver/commit?id=ec9c97c6bf70b523bc500bd3adf62176f1bb33a4http://rhn.redhat.com/errata/RHSA-2011-1359.htmlhttp://rhn.redhat.com/errata/RHSA-2011-1360.htmlhttp://www.openwall.com/lists/oss-security/2011/09/22/7http://www.openwall.com/lists/oss-security/2011/09/23/4http://www.openwall.com/lists/oss-security/2011/09/23/6https://bugs.freedesktop.org/show_bug.cgi?id=28823https://bugzilla.redhat.com/show_bug.cgi?id=740954http://cgit.freedesktop.org/xorg/xserver/commit?id=3f0d3f4d97bce75c1828635c322b6560a45a037fhttp://cgit.freedesktop.org/xorg/xserver/commit?id=6c69235a9dfc52e4b4e47630ff4bab1a820eb543http://cgit.freedesktop.org/xorg/xserver/commit?id=ec9c97c6bf70b523bc500bd3adf62176f1bb33a4http://rhn.redhat.com/errata/RHSA-2011-1359.htmlhttp://rhn.redhat.com/errata/RHSA-2011-1360.htmlhttp://www.openwall.com/lists/oss-security/2011/09/22/7http://www.openwall.com/lists/oss-security/2011/09/23/4http://www.openwall.com/lists/oss-security/2011/09/23/6https://bugs.freedesktop.org/show_bug.cgi?id=28823https://bugzilla.redhat.com/show_bug.cgi?id=740954
2012-09-05
Published