{"id":"CVE-2017-10972","aliases":["DEBIAN-CVE-2017-10972","DLA-1026-1","DSA-3905-1","EUVD-2017-2610","GHSA-2fw8-6c95-mmp8","MGASA-2017-0269","SUSE-SU-2017:1850-1","SUSE-SU-2017:1859-1","SUSE-SU-2017:1860-1","SUSE-SU-2017:1861-1","UBUNTU-CVE-2017-10972","USN-3362-1"],"status":"published","title":"Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before...","description":"Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.023,"percentile":0.83407,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-665"],"published":"2017-07-06T00:00:00Z","modified":"2026-10-20T10:47:44Z","fixes":[{"ecosystem":"Debian:12","package":"xorg-server","fixed_in":["2:1.19.3-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xorg-server","fixed_in":["2:1.19.3-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xorg-server","fixed_in":["2:1.19.3-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","fixed_in":["2:1.15.1-0ubuntu2.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","fixed_in":["2:1.18.3-1ubuntu2.3~trusty2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","fixed_in":["2:1.18.4-0ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","fixed_in":["2:1.18.4-1ubuntu6.1~16.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.3-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.3-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.3-2"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.12.4-6+deb7u7"}]}],"versions":["2:1.12.4-6","2:1.12.4-6+deb7u1","2:1.12.4-6+deb7u2","2:1.12.4-6+deb7u3","2:1.12.4-6+deb7u4","2:1.12.4-6+deb7u5","2:1.12.4-6+deb7u6"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.4-1+deb8u1"}]}],"versions":["2:1.16.4-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.2-1+deb9u1"}]}],"versions":["2:1.19.2-1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:5","package":"x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-2.2.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.121.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.121.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.121.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.121.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.121.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.121.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.15.2-53.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.15.2-53.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.15.2-53.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-74.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-74.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-74.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-74.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-74.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.15.2-30.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.15.2-30.22.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.15.1-0ubuntu2.9"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.3-1ubuntu2.3~trusty2"}]}],"versions":["2:1.18.3-1ubuntu2.2~trusty1","2:1.18.3-1ubuntu2.2~trusty2","2:1.18.3-1ubuntu2.2~trusty3","2:1.18.3-1ubuntu2.3~trusty1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-0ubuntu0.3"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-1ubuntu6.1~16.04.2"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.15.1-0ubuntu2.9"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.3-1ubuntu2.3~trusty2"}]}],"versions":["2:1.18.3-1ubuntu2.2~trusty1","2:1.18.3-1ubuntu2.2~trusty2","2:1.18.3-1ubuntu2.2~trusty3","2:1.18.3-1ubuntu2.3~trusty1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-0ubuntu0.3"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-1ubuntu6.1~16.04.2"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1"],"bundled":3}],"products":[{"vendor":"x.org","product":"x_server"}],"references":[{"url":"http://www.debian.org/security/2017/dsa-3905","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/99543","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1a00eca3ffc5489ced","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1035283","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-10972"},{"url":"https://github.com/advisories/GHSA-2fw8-6c95-mmp8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-10972","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0269.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21191","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-06/msg00070.html","tags":["web"]},{"url":"https://usn.ubuntu.com/usn/usn-3362-1/","tags":["web"]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171850-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1035283","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10972","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171859-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171860-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171861-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-10972","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/07/06/6","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3362-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-10972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2624","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-10971","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-10972","description":"Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.","status":"published","published":"2017-07-06T11:00:00Z","modified":"2024-08-05T17:57:56.82Z","updated_at":"2026-11-02T14:33:13.606903Z"}],"euvd":[{"id":"EUVD-2017-2610","description":"Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.","status":"published","published":"2017-07-06T11:00:00Z","modified":"2024-08-05T17:57:56Z","updated_at":"2026-11-03T02:23:24.743229Z"}],"ghsa":[{"id":"GHSA-2fw8-6c95-mmp8","title":"Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before...","description":"Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.","status":"published","published":"2022-05-13T01:42:01Z","modified":"2023-02-02T05:00:46Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T14:51:02.304407Z"}],"nvd":[{"id":"CVE-2017-10972","description":"Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.","status":"published","published":"2017-07-06T11:29:00.273Z","modified":"2026-06-17T01:01:01.15Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-665"],"updated_at":"2026-11-02T14:03:51.893212Z"}],"osv":[{"id":"CVE-2017-10972","description":"Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.","status":"published","published":"2017-07-06T11:29:00.273Z","modified":"2026-10-20T10:47:44.170690577Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:03.851821Z"},{"id":"DEBIAN-CVE-2017-10972","description":"Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.","status":"published","published":"2017-07-06T11:29:00.273Z","modified":"2026-09-01T20:03:40.997247654Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-10972","description":"Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server before 2017-06-19 allowed authenticated malicious users to access potentially privileged data from the X server.","status":"published","published":"2017-07-06T00:00:00Z","modified":"2026-04-22T11:10:45.733372Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-1026-1","title":"xorg-server - security update","status":"published","published":"2017-07-14T00:00:00Z","modified":"2026-03-09T01:00:42.170561Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3905-1","title":"xorg-server - security update","status":"published","published":"2017-07-09T00:00:00Z","modified":"2026-03-09T01:22:09.82804Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0269","title":"Updated x11-server packages fix security vulnerabilities","description":"Eric Sesterhenn discovered that the X.Org X server incorrectly compared\nMIT cookies. An attacker could possibly use this issue to perform a\ntiming attack and recover the MIT cookie (CVE-2017-2624).\n\nIt was discovered that the X.Org X server incorrectly handled endianness\nconversion of certain X events. An attacker able to connect to an X\nserver, either locally or remotely, could use this issue to crash the\nserver, or possibly execute arbitrary code as an administrator\n(CVE-2017-10971).\n\nIt was discovered that the X.Org X server incorrectly handled endianness\nconversion of certain X events. An attacker able to connect to an X\nserver, either locally or remotely, could use this issue to possibly\nobtain sensitive information (CVE-2017-10972).\n\nUse-after-free issue in an unused function in XDM (boo#1025035).\n","status":"published","published":"2017-08-15T09:57:10Z","modified":"2026-04-16T06:25:08.581672408Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"SUSE-SU-2017:1850-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2017-10971: Fix endianess handling of GenericEvent to prevent a stack overflow by clients. (bnc#1035283)\n- Make sure the type of all events to be sent by ProcXSendExtensionEvent are in the\n  allowed range.\n- CVE-2017-10972: Initialize the xEvent eventT with zeros to avoid information leakage.\n\n","status":"published","published":"2017-07-12T14:39:03Z","modified":"2026-02-04T03:06:32.806377Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:1859-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server provides the following fixes:\n\n- CVE-2017-10971: Fix endianess handling of GenericEvent to prevent a stack overflow by clients. (bnc#1035283)\n- Make sure the type of all events to be sent by ProcXSendExtensionEvent are in the\n  allowed range.\n- CVE-2017-10972: Initialize the xEvent eventT with zeros to avoid information leakage.\n\n","status":"published","published":"2017-07-14T10:04:04Z","modified":"2026-02-04T02:25:45.638599Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:1860-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server provides the following fixes:\n\n- CVE-2017-10971: Fix endianess handling of GenericEvent to prevent a stack overflow by clients. (bnc#1035283)\n- Make sure the type of all events to be sent by ProcXSendExtensionEvent are in the\n  allowed range.\n- CVE-2017-10972: Initialize the xEvent eventT with zeros to avoid information leakage.\n\n","status":"published","published":"2017-07-14T10:03:43Z","modified":"2026-02-04T02:52:17.487305Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:1861-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2017-10971: Fix endianess handling of GenericEvent to prevent a stack overflow by clients. (bnc#1035283)\n- Make sure the type of all events to be sent by ProcXSendExtensionEvent are in the\n  allowed range.\n- CVE-2017-10972: Initialize the xEvent eventT with zeros to avoid information leakage.\n\n","status":"published","published":"2017-07-14T10:04:18Z","modified":"2026-02-04T03:13:35.991808Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-3362-1","title":"xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial vulnerabilities","description":"It was discovered that the X.Org X server incorrectly handled endianness\nconversion of certain X events. An attacker able to connect to an X server,\neither locally or remotely, could use this issue to crash the server, or\npossibly execute arbitrary code as an administrator. (CVE-2017-10971)\n\nIt was discovered that the X.Org X server incorrectly handled endianness\nconversion of certain X events. An attacker able to connect to an X server,\neither locally or remotely, could use this issue to possibly obtain\nsensitive information. (CVE-2017-10972)\n\nEric Sesterhenn discovered that the X.Org X server incorrectly compared\nMIT cookies. An attacker could possibly use this issue to perform a timing\nattack and recover the MIT cookie. (CVE-2017-2624)\n","status":"published","published":"2017-07-24T16:37:00Z","modified":"2026-04-22T09:37:27.964037Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}