CVE-2014-8091 Null dereference in n/a
Remote attackers can crash the X.Org server via a crafted connection request when SUN-DES-1 authentication is enabled, causing denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-8091?
CVE-2014-8091 is a medium-severity vulnerability in X.org X Server, published on 10 Dec 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
X.Org X Window System (aka X11 and X) X11R5 and X.Org Server (aka xserver and xorg-server) before 1.16.3, when using SUN-DES-1 (Secure RPC) authentication credentials, does not check the return value of a malloc call, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a crafted connection request.
Which versions are affected by CVE-2014-8091?
It affects 2 products.
Products include X.org X11, X.org X Server.
How do I fix CVE-2014-8091?
Upgrade to a fixed version.
Is CVE-2014-8091 being exploited?
There is no known exploitation of CVE-2014-8091 in the wild and no public exploit code.
Other vulnerabilities in X.org X Server
Sources
Also known as DEBIAN-CVE-2014-8091, GHSA-3443-38jq-4qwq, UBUNTU-CVE-2014-8091.