Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

X.Org Server may crash with SUN-DES-1 authentication

CVE-2014-8091 · published 11 years ago
Summary

Versions of the X.Org display server older than 1.16.3 that use the SUN-DES-1 (a secure login method) are affected. A specially crafted network request can cause the server to fail while allocating memory, leading it to stop and shut down the graphical desktop for all users. Upgrade the X.Org server to version 1.16.3 or later, or switch to a different authentication method, to avoid the crash.

What to do
  • Update debian xorg-server to version 2:1.16.2.901-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian xorg-server < 2:1.16.2.901-1
Fix: upgrade to 2:1.16.2.901-1
Debian:13 debian xorg-server < 2:1.16.2.901-1
Fix: upgrade to 2:1.16.2.901-1
Debian:14 debian xorg-server < 2:1.16.2.901-1
Fix: upgrade to 2:1.16.2.901-1
– x.org x_server <= 1.16.2
cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
– x.org x11 5.0
cpe:2.3:a:x.org:x11:5.0:*:*:*:*:*:*:*
Original advisory text
X.Org X Window System (aka X11 and X) X11R5 and X.Org Server (aka xserver and xorg-server) before 1.16.3, when using SUN-DES-1 (Secure RPC) authentication credentials, does not check the return val...
X.Org X Window System (aka X11 and X) X11R5 and X.Org Server (aka xserver and xorg-server) before 1.16.3, when using SUN-DES-1 (Secure RPC) authentication credentials, does not check the return value of a malloc call, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a crafted connection request.
References
Severity
4.3 Medium
Exploitation
4% chance of attack within 30 days
Timeline
Published10 Dec 2014
Updated24 Oct 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2014-8091 · OSV
CVE-2014-8091 · NVD
Track software like this
Free during beta