The remote NewStart CGSL host, running version MAIN 6.02, has libX11 packages installed that are affected by multiple vulnerabilities:

  - A missing validation flaw was found in libX11. This flaw allows an attacker to inject X11 protocol     commands on X clients, and in some cases, also bypass, authenticate (via injection of control characters),     or potentially execute arbitrary code with permissions of the application compiled with libX11. The     highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
    (CVE-2021-31535)

  - A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in     libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of     the arrays that those functions write to, using those IDs as array indexes. They trust that they were     called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X     servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-     bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other     portions of the Display structure and not write outside the bounds of the Display structure itself,     possibly causing the client to crash with this memory corruption. (CVE-2023-3138)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202407-21 (X.Org X11 library: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in X.Org X11 library. Please review the CVE identifiers     referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 734b8f46-773d-4fef-bed3-61114fe8e4c5 advisory.

  - The X.Org project reports: The functions in src/InitExt.c in libX11 prior to 1.8.6 do not check     that the values provided for the Request, Event, or Error IDs are             within the bounds of the     arrays that those functions write to, using             those IDs as array indexes.  Instead they trusted     that they were called             with values provided by an Xserver that was adhering to the bounds     specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a     single byte for these values, an             out-of-bounds value provided by a malicious server (or a     malicious             proxy-in-the-middle) can only overwrite other portions of the Display     structure and not write outside the bounds of the Display structure             itself.  Testing has found     it is possible to at least cause the client             to crash with this memory corruption.
    (CVE-2023-3138)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:2614-1 advisory.

    - CVE-2023-3138: Fixed buffer overflows in InitExt.c (bsc#1212102).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libX11 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in     libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of     the arrays that those functions write to, using those IDs as array indexes. They trust that they were     called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X     servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-     bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other     portions of the Display structure and not write outside the bounds of the Display structure itself,     possibly causing the client to crash with this memory corruption. (CVE-2023-3138)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libX11 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in     libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of     the arrays that those functions write to, using those IDs as array indexes. They trust that they were     called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X     servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-     bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other     portions of the Display structure and not write outside the bounds of the Display structure itself,     possibly causing the client to crash with this memory corruption. (CVE-2023-3138)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libX11 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in     libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of     the arrays that those functions write to, using those IDs as array indexes. They trust that they were     called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X     servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-     bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other     portions of the Display structure and not write outside the bounds of the Display structure itself,     possibly causing the client to crash with this memory corruption. (CVE-2023-3138)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of libX11 installed on the remote host is prior to 1.6.0-2.2.15. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1782 advisory.

    A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in     libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of     the arrays that those functions write to, using those IDs as array indexes. They trust that they were     called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X     servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-     bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other     portions of the Display structure and not write outside the bounds of the Display structure itself,     possibly causing the client to crash with this memory corruption. (CVE-2023-3138)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:7029 advisory.

  - A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in     libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of     the arrays that those functions write to, using those IDs as array indexes. They trust that they were     called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X     servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-     bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other     portions of the Display structure and not write outside the bounds of the Display structure itself,     possibly causing the client to crash with this memory corruption. (CVE-2023-3138)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the libX11-1.7.0-8.el9 build changelog.

  - rhbz#2213763 (CVE-2023-3138)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by a vulnerability as referenced in the USN-6168-1 advisory.

    Gregory James Duck discovered that libx11 incorrectly handled certain Request, Event, or Error IDs. If a     user were tricked into connecting to a malicious X Server, a remote attacker could possibly use this issue     to cause libx11 to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
206845	NewStart CGSL MAIN 6.02 : libX11 Multiple Vulnerabilities (NS-SA-2024-0059)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	critical
201938	GLSA-202407-21 : X.Org X11 library: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/7/6	2025/9/24	high
177399	FreeBSD : libX11 -- Sub-object overflows (734b8f46-773d-4fef-bed3-61114fe8e4c5)	Nessus	FreeBSD Local Security Checks	2023/6/16	2023/7/10	high
177549	SUSE SLED15: libX11-6 / libX11-6-32bit / libX11-data / libX11-devel / etc (SUSE-SU-2023:2614-1)	Nessus	SuSE Local Security Checks	2023/6/23	2026/6/26	high
188222	EulerOS 2.0 SP11 : libX11 (EulerOS-SA-2023-2862)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
188245	EulerOS 2.0 SP10 : libX11 (EulerOS-SA-2023-2790)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
188311	EulerOS 2.0 SP11 : libX11 (EulerOS-SA-2023-2845)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
188628	EulerOS Virtualization 2.11.0 : libX11 (EulerOS-SA-2023-3073)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
188640	EulerOS Virtualization 3.0.6.0 : libX11 (EulerOS-SA-2023-3436)	Nessus	Huawei Local Security Checks	2024/1/16	2024/1/16	high
178500	Amazon Linux AMI : libX11 (ALAS-2023-1782)	Nessus	Amazon Linux Local Security Checks	2023/7/20	2024/12/11	high
185636	CentOS 8 : libX11 (CESA-2023:7029)	Nessus	CentOS Local Security Checks	2023/11/14	2023/11/14	high
191216	CentOS 9 : libX11-1.7.0-8.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	high
177356	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : libx11 vulnerability (USN-6168-1)	Nessus	Ubuntu Local Security Checks	2023/6/15	2024/8/27	high

检测

插件搜索

critical

high

high

high

high

high

high

high

high

high

high

high

high