7.2

CVE-2018-14665

Exploit
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
X.Org ≫ X Server Version < 1.20.3
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version18.10
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 27.04% 0.978
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.6 0.7 5.9
CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html
http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html
http://www.securityfocus.com/bid/105741
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041948
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:3410
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665
Patch
Third Party Advisory
Issue Tracking
https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e
Patch
Third Party Advisory
https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170
Patch
Third Party Advisory
https://lists.x.org/archives/xorg-announce/2018-October/002927.html
Patch
Vendor Advisory
Mitigation
https://security.gentoo.org/glsa/201810-09
Third Party Advisory
https://usn.ubuntu.com/3802-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4328
Third Party Advisory
https://www.exploit-db.com/exploits/45697/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/45742/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/45832/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/45908/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/45922/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/45938/
Third Party Advisory
Exploit
VDB Entry
https://www.exploit-db.com/exploits/46142/
Third Party Advisory
Exploit
VDB Entry
https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html
Third Party Advisory
Exploit