{"id":"CVE-2017-12183","aliases":["ALPINE-CVE-2017-12183","BELL-CVE-2017-12183","DEBIAN-CVE-2017-12183","DLA-1186-1","DSA-4000-1","EUVD-2017-3758","GHSA-f4jr-cvv4-j93w","MGASA-2017-0401","SUSE-SU-2017:3025-1","SUSE-SU-2017:3047-1","UBUNTU-CVE-2017-12183","USN-3456-1"],"status":"published","title":"xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing...","description":"xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04494,"percentile":0.91551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-391"],"published":"2017-10-12T00:00:00Z","modified":"2026-10-20T10:48:01Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xorg-server","fixed_in":["2:1.19.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xorg-server","fixed_in":["2:1.19.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xorg-server","fixed_in":["2:1.19.5-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","fixed_in":["2:1.15.1-0ubuntu2.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","fixed_in":["2:1.18.3-1ubuntu2.3~trusty4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","fixed_in":["2:1.18.4-0ubuntu0.7"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","fixed_in":["2:1.19.3-1ubuntu1~16.04.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.5-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.12.4-6+deb7u8"}]}],"versions":["2:1.12.4-6","2:1.12.4-6+deb7u1","2:1.12.4-6+deb7u2","2:1.12.4-6+deb7u3","2:1.12.4-6+deb7u4","2:1.12.4-6+deb7u5","2:1.12.4-6+deb7u6","2:1.12.4-6+deb7u7"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.4-1+deb8u2"}]}],"versions":["2:1.16.4-1","2:1.16.4-1+deb8u1"],"bundled":14},{"source":"osv","ecosystem":"Debian:9","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.2-1+deb9u2"}]}],"versions":["2:1.19.2-1","2:1.19.2-1+deb9u1"],"bundled":14},{"source":"osv","ecosystem":"Mageia:6","package":"x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-1.1.mga6"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.16.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.16.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.16.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.15.1-0ubuntu2.11"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7","2:1.15.1-0ubuntu2.9","2:1.15.1-0ubuntu2.10"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.3-1ubuntu2.3~trusty4"}]}],"versions":["2:1.18.3-1ubuntu2.2~trusty1","2:1.18.3-1ubuntu2.2~trusty2","2:1.18.3-1ubuntu2.2~trusty3","2:1.18.3-1ubuntu2.3~trusty1","2:1.18.3-1ubuntu2.3~trusty2","2:1.18.3-1ubuntu2.3~trusty3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-0ubuntu0.7"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2","2:1.18.4-0ubuntu0.3","2:1.18.4-0ubuntu0.4","2:1.18.4-0ubuntu0.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.3-1ubuntu1~16.04.4"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1","2:1.18.4-1ubuntu6.1~16.04.2","2:1.19.3-1ubuntu1~16.04.2","2:1.19.3-1ubuntu1~16.04.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.15.1-0ubuntu2.11"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7","2:1.15.1-0ubuntu2.9","2:1.15.1-0ubuntu2.10"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.3-1ubuntu2.3~trusty4"}]}],"versions":["2:1.18.3-1ubuntu2.2~trusty1","2:1.18.3-1ubuntu2.2~trusty2","2:1.18.3-1ubuntu2.2~trusty3","2:1.18.3-1ubuntu2.3~trusty1","2:1.18.3-1ubuntu2.3~trusty2","2:1.18.3-1ubuntu2.3~trusty3"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-0ubuntu0.7"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2","2:1.18.4-0ubuntu0.3","2:1.18.4-0ubuntu0.4","2:1.18.4-0ubuntu0.6"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.3-1ubuntu1~16.04.4"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1","2:1.18.4-1ubuntu6.1~16.04.2","2:1.19.3-1ubuntu1~16.04.2","2:1.19.3-1ubuntu1~16.04.3"],"bundled":12}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"the x.org foundation","product":"xorg-x11-server"},{"vendor":"the xorg project","product":"xorg-x11-server"},{"vendor":"x.org","product":"x_server"}],"references":[{"url":"https://www.debian.org/security/2017/dsa-4000","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://cgit.freedesktop.org/xorg/xserver/commit/?id=55caa8b08c84af2b50fbc936cf334a5a93dd7db5","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201711-05","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1509224","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-12183"},{"url":"https://github.com/advisories/GHSA-f4jr-cvv4-j93w"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-12183","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-12183","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-12183","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0401.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21848","tags":["report"]},{"url":"https://bugs.freedesktop.org/show_bug.cgi?id=101730","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/7PTJE7ZFQ6WA3TNLKJYRT5SI74CWC3ID/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173025-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1025084","tags":["report"]},{"url":"https://bugzilla.suse.com/1051150","tags":["report"]},{"url":"https://bugzilla.suse.com/1063034","tags":["report"]},{"url":"https://bugzilla.suse.com/1063035","tags":["report"]},{"url":"https://bugzilla.suse.com/1063037","tags":["report"]},{"url":"https://bugzilla.suse.com/1063038","tags":["report"]},{"url":"https://bugzilla.suse.com/1063039","tags":["report"]},{"url":"https://bugzilla.suse.com/1063040","tags":["report"]},{"url":"https://bugzilla.suse.com/1063041","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13723","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1022727","tags":["report"]},{"url":"https://bugzilla.suse.com/1052984","tags":["report"]},{"url":"https://bugzilla.suse.com/1061107","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13721","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-12183","tags":["report"]},{"url":"https://lists.x.org/archives/xorg-announce/2017-October/002814.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3456-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-12183","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12177","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12178","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12179","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12180","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12182","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12184","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12185","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-12187","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-12183","description":"xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.","status":"published","published":"2018-01-24T15:00:00Z","modified":"2024-09-16T19:21:10.764Z","cwes":["CWE-391"],"updated_at":"2026-11-02T14:33:17.264801Z"}],"euvd":[{"id":"EUVD-2017-3758","description":"xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.","status":"published","published":"2018-01-24T15:00:00Z","modified":"2024-09-16T19:21:10Z","updated_at":"2026-11-03T00:55:23.696592Z"}],"ghsa":[{"id":"GHSA-f4jr-cvv4-j93w","title":"xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing...","description":"xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.","status":"published","published":"2022-05-13T01:38:12Z","modified":"2025-08-29T15:31:38Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-20","CWE-391"],"updated_at":"2026-11-02T15:03:27.292795Z"}],"nvd":[{"id":"CVE-2017-12183","description":"xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.","status":"published","published":"2018-01-24T15:29:00.7Z","modified":"2026-06-17T01:02:51.447Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-391","CWE-20"],"updated_at":"2026-11-02T14:04:13.257031Z"}],"osv":[{"id":"ALPINE-CVE-2017-12183","description":"xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.","status":"published","published":"2018-01-24T15:29:00.7Z","modified":"2026-06-15T18:24:11.954286662Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-12183","title":"CVE-2017-12183 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:08.529291Z","modified":"2026-01-26T09:48:55.302437Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-12183","description":"xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.","status":"published","published":"2018-01-24T15:29:00.7Z","modified":"2026-10-20T10:48:01.789878188Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"DEBIAN-CVE-2017-12183","description":"xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.","status":"published","published":"2018-01-24T15:29:00.7Z","modified":"2026-09-01T20:03:42.046655285Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.50097Z"},{"id":"UBUNTU-CVE-2017-12183","description":"xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.","status":"published","published":"2017-10-12T00:00:00Z","modified":"2026-04-22T11:12:51.078096Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:13.729565Z"},{"id":"DLA-1186-1","title":"xorg-server - security update","status":"published","published":"2017-11-23T00:00:00Z","modified":"2026-03-09T01:01:42.199331Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4000-1","title":"xorg-server - security update","status":"published","published":"2017-10-17T00:00:00Z","modified":"2026-03-09T01:23:18.399242Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0401","title":"Updated x11-server packages fix security vulnerabilities \u0026 bugs","description":"The upstream 1.19.4 update we pushed as:\nhttp://advisories.mageia.org/MGASA-2017-0366.html\nintroduced a regression in PRIME syncronization.\n\nUpstream released a 1.19.5 that fixes that and a lot of security fixes:\nCVE-2017-12176 to CVE-2017-12187\n\nAlso added a fix for \"XShmGetImage: fix censoring\" that is described as:\n\"Visually this fixes chromium/firefox window sharing in multiscreen\nconfigurations - without this patch most of the windows on 'secondary'\nscreens are black.\"\n\nThis also should fix https://bugs.freedesktop.org/show_bug.cgi?id=101730.\n","status":"published","published":"2017-11-06T08:22:52Z","modified":"2026-04-16T06:24:00.510434949Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:3025-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server provides several fixes.\n\nThese security issues were fixed:\n\n- CVE-2017-13723: Prevent local DoS via unusual characters in XkbAtomText and\n  XkbStringText (bsc#1051150).\n- Improve the entropy when generating random data used in X.org server authorization\n  cookies generation by using getentropy() and getrandom() when available (bsc#1025084)\n- CVE-2017-12184,CVE-2017-12185,CVE-2017-12186,CVE-2017-12187: Fixed\n  unvalidated lengths in multiple extensions (bsc#1063034)\n- CVE-2017-12183: Fixed some unvalidated lengths in the XFIXES\n  extension. (bsc#1063035)\n- CVE-2017-12180,CVE-2017-12181,CVE-2017-12182: Fixed various unvalidated\n  lengths in the XFree86-VidMode/XFree86-DGA/XFree86-DRI extensions\n  (bsc#1063037)\n- CVE-2017-12179: Fixed an integer overflow and unvalidated length in\n  (S)ProcXIBarrierReleasePointer in Xi (bsc#1063038)\n- CVE-2017-12178: Fixed a wrong extra length check in\n  ProcXIChangeHierarchy in Xi (bsc#1063039)\n- CVE-2017-12177: Fixed an unvalidated variable-length request in\n  ProcDbeGetVisualInfo (bsc#1063040)\n- CVE-2017-12176: Fixed an unvalidated extra length in\n  ProcEstablishConnection (bsc#1063041)\n\n\n","status":"published","published":"2017-11-16T11:57:00Z","modified":"2026-02-04T02:27:55.145118Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:3047-1","title":"Security update for xorg-x11-server","description":"\n\nThis update for xorg-x11-server fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-13721: Missing validation of shmseg resource id in Xext/XShm\n  could lead to shared memory segments of other users beeing freed\n  (bnc#1052984)\n- CVE-2017-13723: A local denial of service via unusual characters in XkbAtomText and XkbStringText was fixed (bnc#1051150)\n- CVE-2017-12184,CVE-2017-12185,CVE-2017-12186,CVE-2017-12187: Fixed\n  unvalidated lengths in multiple extensions (bsc#1063034)\n- CVE-2017-12183: Fixed some unvalidated lengths in the XFIXES\n  extension. (bsc#1063035)\n- CVE-2017-12180,CVE-2017-12181,CVE-2017-12182: Fixed various unvalidated\n  lengths in the XFree86-VidMode/XFree86-DGA/XFree86-DRI extensions\n  (bsc#1063037)\n- CVE-2017-12179: Fixed an integer overflow and unvalidated length in\n  (S)ProcXIBarrierReleasePointer in Xi (bsc#1063038)\n- CVE-2017-12178: Fixed a wrong extra length check in\n  ProcXIChangeHierarchy in Xi (bsc#1063039)\n- CVE-2017-12177: Fixed an unvalidated variable-length request in\n  ProcDbeGetVisualInfo (bsc#1063040)\n- CVE-2017-12176: Fixed an unvalidated extra length in\n  ProcEstablishConnection (bsc#1063041)\n\n\nThese non-security issues were fixed:\n\n- Make colormap/gamma glue code work with the RandR extension disabled. This prevents it\n  from crashing and showing wrong colors. (bsc#1061107)\n- Recognize ssh as a remote client to fix launching applications remotely when using DRI3.\n  (bsc#1022727)\n","status":"published","published":"2017-11-22T16:16:29Z","modified":"2026-02-04T02:13:06.124337Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-3456-1","title":"xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial vulnerabilities","description":"It was discovered that the X.Org X server incorrectly handled certain\nlengths. An attacker able to connect to an X server, either locally or\nremotely, could use these issues to crash the server, or possibly execute\narbitrary code.\n","status":"published","published":"2017-10-17T16:33:35Z","modified":"2026-04-22T09:40:15.86588Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}