CVE-2013-4396
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server...
CVE-2013-4396 is a medium vulnerability (CVSS 6.5) in X X.org X11, published October 10, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.08%, the 90th percentile. Fixed in xorg-server 2:1.14.3-4.
- Severity
- 6.5 MediumCVSS 2.0, NVD
- Exploit chance
- 4.08%EPSS, 90th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2:1.14.3-4xorg-server +66 more
Description
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xorg-serverDebian:12 | before 2:1.14.3-4 | 2:1.14.3-4 |
xorg-serverDebian:13 | before 2:1.14.3-4 | 2:1.14.3-4 |
xorg-serverDebian:14 | before 2:1.14.3-4 | 2:1.14.3-4 |
xorg-serverDebian:6.0 | before 2:1.7.7-17, plus listed versions 2:1.7.7-112:1.7.7-122:1.7.7-132:1.7.7-142:1.7.7-152:1.7.7-16 | 2:1.7.7-17 |
xorg-serverDebian:7 | before 2:1.12.4-6+deb7u1, plus listed versions 2:1.12.4-6 | 2:1.12.4-6+deb7u1 |
x11-serverMageia:2 | before 1.11.4-2.4.mga2 | 1.11.4-2.4.mga2 |
x11-serverMageia:3 | before 1.13.4-2.2.mga3 | 1.13.4-2.2.mga3 |
xorg-x11-serverRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-XdmxRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-XephyrRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
Show 57 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xorg-x11-server-XnestRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-XorgRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-XvfbRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-Xvnc-sourceRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-debuginfoRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-serverRed Hat:enterprise_linux:5::client_workstation | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-debuginfoRed Hat:enterprise_linux:5::client_workstation | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-sdkRed Hat:enterprise_linux:5::client_workstation | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-serverRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-XdmxRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-XephyrRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-XnestRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-XorgRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-XvfbRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-Xvnc-sourceRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-debuginfoRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-server-sdkRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.101.el5_10.1 | 0:1.1.1-48.101.el5_10.1 |
xorg-x11-serverRed Hat:enterprise_linux:6::client | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XephyrRed Hat:enterprise_linux:6::client | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XorgRed Hat:enterprise_linux:6::client | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-commonRed Hat:enterprise_linux:6::client | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-debuginfoRed Hat:enterprise_linux:6::client | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XdmxRed Hat:enterprise_linux:6::client | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XnestRed Hat:enterprise_linux:6::client | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XvfbRed Hat:enterprise_linux:6::client | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-develRed Hat:enterprise_linux:6::client | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-sourceRed Hat:enterprise_linux:6::client | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-serverRed Hat:enterprise_linux:6::computenode | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XdmxRed Hat:enterprise_linux:6::computenode | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XephyrRed Hat:enterprise_linux:6::computenode | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XnestRed Hat:enterprise_linux:6::computenode | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XorgRed Hat:enterprise_linux:6::computenode | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XvfbRed Hat:enterprise_linux:6::computenode | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-commonRed Hat:enterprise_linux:6::computenode | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-debuginfoRed Hat:enterprise_linux:6::computenode | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-develRed Hat:enterprise_linux:6::computenode | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-sourceRed Hat:enterprise_linux:6::computenode | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-serverRed Hat:enterprise_linux:6::server | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XephyrRed Hat:enterprise_linux:6::server | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XorgRed Hat:enterprise_linux:6::server | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-commonRed Hat:enterprise_linux:6::server | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-debuginfoRed Hat:enterprise_linux:6::server | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XdmxRed Hat:enterprise_linux:6::server | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XnestRed Hat:enterprise_linux:6::server | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XvfbRed Hat:enterprise_linux:6::server | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-develRed Hat:enterprise_linux:6::server | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-sourceRed Hat:enterprise_linux:6::server | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-serverRed Hat:enterprise_linux:6::workstation | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XephyrRed Hat:enterprise_linux:6::workstation | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XorgRed Hat:enterprise_linux:6::workstation | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-commonRed Hat:enterprise_linux:6::workstation | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-debuginfoRed Hat:enterprise_linux:6::workstation | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XdmxRed Hat:enterprise_linux:6::workstation | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XnestRed Hat:enterprise_linux:6::workstation | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-XvfbRed Hat:enterprise_linux:6::workstation | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-develRed Hat:enterprise_linux:6::workstation | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
xorg-x11-server-sourceRed Hat:enterprise_linux:6::workstation | before 0:1.13.0-11.1.el6_4.2 | 0:1.13.0-11.1.el6_4.2 |
What each source reports
NVD Score used
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
- Record
CVE-2013-4396- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE ListNo score
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
- Record
CVE-2013-4396- Updated
- 2026-11-02
EUVDEUVD-2013-4275No score
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
- Record
EUVD-2013-4275- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qw42-qhpr-5gg9No score
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server...
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
- Record
GHSA-qw42-qhpr-5gg9- Updated
- 2026-11-02
OSVNo score
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
- Record
CVE-2013-4396- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-4396No score
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.
- Record
DEBIAN-CVE-2013-4396- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2013-0317No score
Updated x11-server packages fix CVE-2013-4396
Updated x11-server packages fix security vulnerability:
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure (CVE-2013-4396).
- Record
MGASA-2013-0317- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10518-1No score
xorg-x11-server-7.6_1.18.4-2.1 on GA media
These are all security issues fixed in the xorg-x11-server-7.6_1.18.4-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10518-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:0427-1No score
Recommended update for xorg-x11-server
This collective update for xorg-x11-server provides the following fixes:
* Fix a segmentation fault that can occur when X11 packets are
forwarded between a client and a server with different endianess.
(bnc#874903)
* Free software cursor backing pixmap when transition between screens.
This fixes a crash in multi screen support when an assert gets hit.
(bnc#880835)
* Ignore numlock in Xvnc. Following keys from VNC client will be
already modulated by numlock on client side. (bnc#878446)
* Fix crash when Xinerama gets disabled after RanR12 is initialized.
(bnc#878433)
* Prevent crash at the end of 2nd server generation when number of
privates differ between 1st and 2nd. (bnc#883598)
* Move Xinerama disable when only one screen is present to main loop.
(bnc#883598)
* Improve Xinerama command line option handling. (bnc#883598)
* Work around a possible crash when object belongs to a client that no
longer exists. (bnc#883516)
* Try to make keyboard bell ring on all devices attached to master
keyboard. (bnc#879019)
* Implement DeleteInputDeviceRequest in Xvnc to avoid server crash when
the Xserver restarts after a server reset. (bnc#880745).
- Record
SUSE-SU-2015:0427-1- Updated
- 2026-11-02
OSVSUSE-SU-2015:1025-1No score
Recommended update for xorg-x11-server
This collective update for xorg-x11-server provides the following fixes:
* Fix a segmentation fault that can occur when X11 packets are
forwarded between a client and a server with different endianess.
(bnc#874903)
* Free software cursor backing pixmap when transition between screens.
This fixes a crash in multi screen support when an assert gets hit.
(bnc#880835)
* Ignore numlock in Xvnc. Following keys from VNC client will be
already modulated by numlock on client side. (bnc#878446)
* Fix crash when Xinerama gets disabled after RanR12 is initialized.
(bnc#878433)
* Prevent crash at the end of 2nd server generation when number of
privates differ between 1st and 2nd. (bnc#883598)
* Move Xinerama disable when only one screen is present to main loop.
(bnc#883598)
* Improve Xinerama command line option handling. (bnc#883598)
* Work around a possible crash when object belongs to a client that no
longer exists. (bnc#883516)
* Try to make keyboard bell ring on all devices attached to master
keyboard. (bnc#879019)
* Implement DeleteInputDeviceRequest in Xvnc to avoid server crash when
the Xserver restarts after a server reset. (bnc#880745).
- Record
SUSE-SU-2015:1025-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.opensuse.org/opensuse-updates/2013-10/msg00056.html
rhn.redhat.com/errata/RHSA-2013-1426.html
debian.org/security/2013/dsa-2784
ubuntu.com/usn/USN-1990-1
securityfocus.com/bid/62892
Show 53 moreShow less
openwall.com/lists/oss-security/2013/10/08/6
bugzilla.redhat.com/show_bug.cgi?id=1014561
lists.x.org/archives/xorg-announce/2013-October/002332.html
nvd.nist.gov/vuln/detail/CVE-2013-4396
github.com/advisories/GHSA-qw42-qhpr-5gg9
security-tracker.debian.org/tracker/CVE-2013-4396
advisories.mageia.org/MGASA-2013-0317.html
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4396
bugs.mageia.org/show_bug.cgi?id=11428
access.redhat.com/errata/RHSA-2013:1426
security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1426.json
cve.org/CVERecord?id=CVE-2013-4396
suse.com/support/update/announcement/2015/suse-su-20150427-1
bugzilla.suse.com/816813