Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2017-12185: X.org X Server may crash or run code
CVE-2017-12185 · published 8 years ago
Summary
The X.org X Server used in Debian Linux versions older than 1.19.5 has a missing safety check in its screen‑saver feature. A specially crafted program could make the server stop working or potentially run unwanted code. Update the X server to version 1.19.5 or later to fix the issue.
What to do
- Update x.org x_server to version 1.19.5 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| debian | debian_linux |
8.0 9.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| x.org | x_server |
< 1.19.5 cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* |
Original advisory text
xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1509215 Issue Tracking Patch Third Party Advisory VDB Entry
- https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd1... Patch Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html Mailing List Third Party Advisory
- https://www.debian.org/security/2017/dsa-4000 Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-391Unchecked Error Condition
CWE-20Improper Input Validation
Timeline
Published24 Jan 2018
Updated23 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-12185 · NVD
Track software like this
Free during beta