CVE-2014-8093 Integer overflow in n/a

Medium 6.5 Published 10 Dec 2014 Updated 6 Aug 2024

Remote authenticated users can cause denial of service or execute arbitrary code via integer overflows in the X.Org Server GLX extension.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-8093?

CVE-2014-8093 is a medium-severity vulnerability in X.org X Server, published on 10 Dec 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Multiple integer overflows in the GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to the (1) __glXDisp_ReadPixels, (2) __glXDispSwap_ReadPixels, (3) __glXDisp_GetTexImage, (4) __glXDispSwap_GetTexImage, (5) GetSeparableFilter, (6) GetConvolutionFilter, (7) GetHistogram, (8) GetMinmax, (9) GetColorTable, (10) __glXGetAnswerBuffer, (11) __GLX_GET_ANSWER_BUFFER, (12) __glXMap1dReqSize, (13) __glXMap1fReqSize, (14) Map2Size, (15) __glXMap2dReqSize, (16) __glXMap2fReqSize, (17) __glXImageSize, or (18) __glXSeparableFilter2DReqSize function, which triggers an out-of-bounds read or write.

Which versions are affected by CVE-2014-8093?

It affects 3 products.

Products include X.org X11, X.org X Server, X.org Xfree86.

How do I fix CVE-2014-8093?

Upgrade to a fixed version.

Is CVE-2014-8093 being exploited?

There is no known exploitation of CVE-2014-8093 in the wild and no public exploit code.

All X.org X Server vulnerabilities

Sources

Also known as DEBIAN-CVE-2014-8093, GHSA-jv75-r474-7vqf, UBUNTU-CVE-2014-8093.