CVE-2017-10972

published 2017-07-06

CVE-2017-10972: Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access…

medium 6.5 CVSS 3.0

AV N AC L PR L UI N S U C H I N A N

Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
debian	xorg-server	< xorg-server 2:1.19.3-2 (bookworm)	xorg-server 2:1.19.3-2 (bookworm)
x.org	x_server	<= 1.19.3	—
x.org	xorg-server	>= 0 < 2:1.19.3-2	2:1.19.3-2
x.org	xorg-server	>= 0 < 2:1.19.3-2	2:1.19.3-2
x.org	xorg-server	>= 0 < 2:1.19.3-2	2:1.19.3-2
x.org	xorg-server	>= 0 < 2:1.19.3-2	2:1.19.3-2
x.org	xorg-server	>= 0 < 2:1.15.1-0ubuntu2.9	2:1.15.1-0ubuntu2.9
x.org	xorg-server	>= 0 < 2:1.18.4-0ubuntu0.3	2:1.18.4-0ubuntu0.3

CVSS provenance

nvd v3.0 6.5 MEDIUM CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

osv 8.8 HIGH

CWE-665