Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

X.Org Server and XFree86 allow remote users to crash

CVE-2014-8100 · published 11 years ago
Summary

The older X Window graphics system (X.Org Server before version 1.16.3 and XFree86 4.0.1) can be forced to stop working or, in some cases, run unwanted code if someone who can log in remotely sends specially crafted commands. This could interrupt any applications that rely on the graphical display, affecting productivity or service availability. Update the X server to the latest version, or otherwise restrict remote logins and use network firewalls to block access to the X service until it can be patched.

What to do
  • Update debian xorg-server to version 2:1.16.2.901-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian xorg-server < 2:1.16.2.901-1
Fix: upgrade to 2:1.16.2.901-1
Debian:13 debian xorg-server < 2:1.16.2.901-1
Fix: upgrade to 2:1.16.2.901-1
Debian:14 debian xorg-server < 2:1.16.2.901-1
Fix: upgrade to 2:1.16.2.901-1
– x.org xfree86 4.0.1
cpe:2.3:a:x.org:xfree86:4.0.1:*:*:*:*:*:*:*
– x.org x_server <= 1.16.2.99.901
cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
– x.org x11 6.7
cpe:2.3:a:x.org:x11:6.7:*:*:*:*:*:*:*
Original advisory text
The Render extension in XFree86 4.0.1, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial...
The Render extension in XFree86 4.0.1, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) ProcRenderQueryVersion, (2) SProcRenderQueryVersion, (3) SProcRenderQueryPictFormats, (4) SProcRenderQueryPictIndexValues, (5) SProcRenderCreatePicture, (6) SProcRenderChangePicture, (7) SProcRenderSetPictureClipRectangles, (8) SProcRenderFreePicture, (9) SProcRenderComposite, (10) SProcRenderScale, (11) SProcRenderCreateGlyphSet, (12) SProcRenderReferenceGlyphSet, (13) SProcRenderFreeGlyphSet, (14) SProcRenderFreeGlyphs, or (15) SProcRenderCompositeGlyphs function.
References
Severity
6.5 Medium
Exploitation
4% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published10 Dec 2014
Updated25 Oct 2026
First seen1 Sep 2026
Sources
DEBIAN-CVE-2014-8100 · OSV
CVE-2014-8100 · NVD
Track software like this
Free during beta