USN-1232-1 fixed vulnerabilities in the X.Org X server. A regression was found on Ubuntu 10.04 LTS that affected GLX support.

This update temporarily disables the fix for CVE-2010-4818 that introduced the regression.

We apologize for the inconvenience.

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly execute arbitrary code with root privileges. This issue only affected Ubuntu 10.04 LTS and 10.10. (CVE-2010-4818)

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly read arbitrary data from the X server process. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-4819)

Vladz discovered that the X server incorrectly handled lock files. A local attacker could use this flaw to determine if a file existed or not. (CVE-2011-4028)

Vladz discovered that the X server incorrectly handled setting lock file permissions. A local attacker could use this flaw to gain read permissions on arbitrary files and view sensitive information. (CVE-2011-4029).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Multiple input sanitization flaws were found in the X.Org GLX (OpenGL extension to the X Window System) extension. A malicious, authorized client could use these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.
(CVE-2010-4818)

An input sanitization flaw was found in the X.Org Render extension. A malicious, authorized client could use this flaw to leak arbitrary memory from the X.Org server process, or possibly crash the X.Org server. (CVE-2010-4819)

Users of xorg-x11-server should upgrade to these updated packages, which contain backported patches to resolve these issues. All running X.Org server instances must be restarted for this update to take effect.

Multiple input sanitization flaws were found in the X.Org GLX (OpenGL extension to the X Window System) extension. A malicious, authorized client could use these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.
(CVE-2010-4818)

An input sanitization flaw was found in the X.Org Render extension. A malicious, authorized client could use this flaw to leak arbitrary memory from the X.Org server process, or possibly crash the X.Org server. (CVE-2010-4819)

Updated xorg-x11-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Multiple input sanitization flaws were found in the X.Org GLX (OpenGL extension to the X Window System) extension. A malicious, authorized client could use these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.
(CVE-2010-4818)

An input sanitization flaw was found in the X.Org Render extension. A malicious, authorized client could use this flaw to leak arbitrary memory from the X.Org server process, or possibly crash the X.Org server. (CVE-2010-4819)

Users of xorg-x11-server should upgrade to these updated packages, which contain backported patches to resolve these issues. All running X.Org server instances must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1359 advisory.

  - X.org: multiple GLX input sanitization flaws (CVE-2010-4818)

  - X.org: ProcRenderAddGlyphs input sanitization flaw (CVE-2010-4819)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-01:01 advisory.

    The X.Org X11 X server     Security issues fixed with this release:
    CVE-2010-4818     CVE-2010-4819     No information available at the time of writing, please refer to the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of xorg-x11 fixes issues that could allow attackers using GLX opcodes to read access to arbitrary memory locations (CVE-2010-4818). Additionally, a crash due to missing bounds checks in the the Glyph Render protocol have been fixed. (CVE-2010-4819)

Access to the X server by the attacker was required to make this work.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Multiple input sanitization flaws were found in the X.Org GLX (OpenGL extension to the X Window System) extension. A malicious, authorized client could use these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.
(CVE-2010-4818)

An input sanitization flaw was found in the X.Org Render extension. A malicious, authorized client could use this flaw to leak arbitrary memory from the X.Org server process, or possibly crash the X.Org server. (CVE-2010-4819)

Users of xorg-x11 should upgrade to these updated packages, which contain a backported patch to resolve these issues. All running X.Org server instances must be restarted for this update to take effect.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1359 advisory.

    [1.7.7-29.2]
    - cve-2011-4818.patch: Multiple input sanitization flaws in GLX and Render

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2011:1360 :

Updated xorg-x11 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Multiple input sanitization flaws were found in the X.Org GLX (OpenGL extension to the X Window System) extension. A malicious, authorized client could use these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.
(CVE-2010-4818)

An input sanitization flaw was found in the X.Org Render extension. A malicious, authorized client could use this flaw to leak arbitrary memory from the X.Org server process, or possibly crash the X.Org server. (CVE-2010-4819)

Users of xorg-x11 should upgrade to these updated packages, which contain a backported patch to resolve these issues. All running X.Org server instances must be restarted for this update to take effect.

USN-1232-1 fixed vulnerabilities in the X.Org X server. A regression was found on Ubuntu 10.04 LTS that affected GLX support, and USN-1232-2 was released to temporarily disable the problematic security fix. This update includes a revised fix for CVE-2010-4818.

We apologize for the inconvenience.

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly execute arbitrary code with root privileges. This issue only affected Ubuntu 10.04 LTS and 10.10. (CVE-2010-4818)

It was discovered that the X server incorrectly handled certain malformed input. An authorized attacker could exploit this to cause the X server to crash, leading to a denial or service, or possibly read arbitrary data from the X server process. This issue only affected Ubuntu 10.04 LTS.
(CVE-2010-4819)

Vladz discovered that the X server incorrectly handled lock files. A local attacker could use this flaw to determine if a file existed or not. (CVE-2011-4028)

Vladz discovered that the X server incorrectly handled setting lock file permissions. A local attacker could use this flaw to gain read permissions on arbitrary files and view sensitive information. (CVE-2011-4029).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for xorg-x11-server and xorg-x11-libs brings improved compatibility fixes and enhancements for X.org. The main feature is support for Multi monitor configurations with independent heads, which used to be supported with SUSE Linux Enterprise 10 (VGA Arbitration Support).

During update to Service Pack 1, the support for AppGroup Extension was removed from the X11 Server. This update fixes this regression and adds back the support. (bnc#709943)

Additionally this update fixes bugs in the AppGroup Extensions, which resulted in Xserver crashes. (bnc#716355)

It also fixes an issue with changing the mouse mode to absolute.
(bnc#704467)

It also fixes an issue with button release on non-core pointing devices. (bnc#698281)

In addition to that, multiple missing or incorrect bounds checking flaws were fixed in in GLX (CVE-2010-4818) and in the X Render Extension (CVE-2010-4819) were fixed, which could be used to crash the X server.

A regression in handling TWM was fixed as well. (bnc#709987)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-320:02 advisory.

    X.Org X11 X server     Security issues fixed with this release:
    CVE-2010-4818     CVE-2010-4819     No information available at the time of writing, please refer to the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated xorg-x11 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

X.Org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Multiple input sanitization flaws were found in the X.Org GLX (OpenGL extension to the X Window System) extension. A malicious, authorized client could use these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.
(CVE-2010-4818)

An input sanitization flaw was found in the X.Org Render extension. A malicious, authorized client could use this flaw to leak arbitrary memory from the X.Org server process, or possibly crash the X.Org server. (CVE-2010-4819)

Users of xorg-x11 should upgrade to these updated packages, which contain a backported patch to resolve these issues. All running X.Org server instances must be restarted for this update to take effect.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
56563	Ubuntu 10.04 LTS : xorg-server regression (USN-1232-2)	Nessus	Ubuntu Local Security Checks	2011/10/20	2019/9/19	high
61151	Scientific Linux Security Update : xorg-x11-server on SL5.x, SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
69572	Amazon Linux AMI : xorg-x11-server (ALAS-2011-13)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	high
56408	CentOS 5 : xorg-x11-server (CESA-2011:1359)	Nessus	CentOS Local Security Checks	2011/10/7	2021/1/4	high
56410	RHEL 5 / 6 : xorg-x11-server (RHSA-2011:1359)	Nessus	Red Hat Local Security Checks	2011/10/7	2024/4/21	high
291496	MiracleLinux 4 : xorg-x11-server-1.7.7-29.2.0.1.AXS4 (AXSA:2012-01:01)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	critical
58143	SuSE 10 Security Update : xorg-x11 (ZYPP Patch Number 7954)	Nessus	SuSE Local Security Checks	2012/2/28	2021/1/19	high
61150	Scientific Linux Security Update : xorg-x11 on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	high
68366	Oracle Linux 5 / 6 : xorg-x11-server (ELSA-2011-1359)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
68367	Oracle Linux 4 : xorg-x11 (ELSA-2011-1360)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
56580	Ubuntu 10.04 LTS / 10.10 : xorg-server vulnerability (USN-1232-3)	Nessus	Ubuntu Local Security Checks	2011/10/21	2019/9/19	high
57139	SuSE 11.1 Security Update : Xorg (SAT Patch Number 5294)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	high
284458	MiracleLinux 3 : xorg-x11-server-1.1.1-48.76.5.0.1.AXS3 (AXSA:2011-320:02)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
56780	CentOS 4 : xorg-x11 (CESA-2011:1360)	Nessus	CentOS Local Security Checks	2011/11/14	2021/1/4	high

检测

插件搜索

high

high

high

high

high

critical

high

high

high

high

high

high

critical

high