CVE-2012-2118 Memory corruption in n/a

Critical 10.0 Published 18 May 2012 Updated 6 Aug 2024

Attackers can cause denial of service or execute arbitrary code via format string specifiers in X.Org X11 input device names.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2012-2118?

CVE-2012-2118 is a critical memory corruption vulnerability in n/a, published on 18 May 2012. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.

Weakness: CWE-20

Which versions are affected by CVE-2012-2118?

It affects 1 product.

Products include X.org X11.

How do I fix CVE-2012-2118?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2012-2118 being exploited?

There is no known exploitation of CVE-2012-2118 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2012-2118, GHSA-wqgf-h892-f3cp.