{"id":"CVE-2017-13723","aliases":["ALPINE-CVE-2017-13723","BELL-CVE-2017-13723","DEBIAN-CVE-2017-13723","DLA-1186-1","DSA-4000-1","EUVD-2017-5240","GHSA-w3w2-h9f5-hrg7","MGASA-2017-0366","SUSE-SU-2017:3025-1","SUSE-SU-2017:3047-1","UBUNTU-CVE-2017-13723","USN-3453-1"],"status":"published","title":"In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to...","description":"In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00443,"percentile":0.38787,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2017-10-09T00:00:00Z","modified":"2026-10-20T10:47:45Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"xorg-server","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xorg-server","fixed_in":["2:1.19.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xorg-server","fixed_in":["2:1.19.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xorg-server","fixed_in":["2:1.19.4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","fixed_in":["2:1.15.1-0ubuntu2.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","fixed_in":["2:1.18.3-1ubuntu2.3~trusty3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","fixed_in":["2:1.18.4-0ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","fixed_in":["2:1.19.3-1ubuntu1~16.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.4-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.12.4-6+deb7u8"}]}],"versions":["2:1.12.4-6","2:1.12.4-6+deb7u1","2:1.12.4-6+deb7u2","2:1.12.4-6+deb7u3","2:1.12.4-6+deb7u4","2:1.12.4-6+deb7u5","2:1.12.4-6+deb7u6","2:1.12.4-6+deb7u7"],"bundled":11},{"source":"osv","ecosystem":"Debian:8","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.16.4-1+deb8u2"}]}],"versions":["2:1.16.4-1","2:1.16.4-1+deb8u1"],"bundled":14},{"source":"osv","ecosystem":"Debian:9","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.2-1+deb9u2"}]}],"versions":["2:1.19.2-1","2:1.19.2-1+deb9u1"],"bundled":14},{"source":"osv","ecosystem":"Mageia:5","package":"x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-2.3.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-1.mga6"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.16.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.16.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.16.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-76.15.2"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.15.1-0ubuntu2.10"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7","2:1.15.1-0ubuntu2.9"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.3-1ubuntu2.3~trusty3"}]}],"versions":["2:1.18.3-1ubuntu2.2~trusty1","2:1.18.3-1ubuntu2.2~trusty2","2:1.18.3-1ubuntu2.2~trusty3","2:1.18.3-1ubuntu2.3~trusty1","2:1.18.3-1ubuntu2.3~trusty2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-0ubuntu0.6"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2","2:1.18.4-0ubuntu0.3","2:1.18.4-0ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.3-1ubuntu1~16.04.3"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1","2:1.18.4-1ubuntu6.1~16.04.2","2:1.19.3-1ubuntu1~16.04.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.15.1-0ubuntu2.10"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7","2:1.15.1-0ubuntu2.9"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.3-1ubuntu2.3~trusty3"}]}],"versions":["2:1.18.3-1ubuntu2.2~trusty1","2:1.18.3-1ubuntu2.2~trusty2","2:1.18.3-1ubuntu2.2~trusty3","2:1.18.3-1ubuntu2.3~trusty1","2:1.18.3-1ubuntu2.3~trusty2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-0ubuntu0.6"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2","2:1.18.4-0ubuntu0.3","2:1.18.4-0ubuntu0.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.3-1ubuntu1~16.04.3"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1","2:1.18.4-1ubuntu6.1~16.04.2","2:1.19.3-1ubuntu1~16.04.2"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"x.org","product":"x_server"}],"references":[{"url":"http://www.securityfocus.com/bid/101253","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://cgit.freedesktop.org/xorg/xserver/commit/?id=94f11ca5cf011ef123bd222cabeaef6f424d76ac","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201710-30","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2017/10/04/10","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.debian.org/security/2017/dsa-4000","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.x.org/archives/xorg-announce/2017-October/002808.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-13723"},{"url":"https://github.com/advisories/GHSA-w3w2-h9f5-hrg7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-13723","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-13723","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-13723","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0366.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21820","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2017/10/04/10","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173025-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1025084","tags":["report"]},{"url":"https://bugzilla.suse.com/1051150","tags":["report"]},{"url":"https://bugzilla.suse.com/1063034","tags":["report"]},{"url":"https://bugzilla.suse.com/1063035","tags":["report"]},{"url":"https://bugzilla.suse.com/1063037","tags":["report"]},{"url":"https://bugzilla.suse.com/1063038","tags":["report"]},{"url":"https://bugzilla.suse.com/1063039","tags":["report"]},{"url":"https://bugzilla.suse.com/1063040","tags":["report"]},{"url":"https://bugzilla.suse.com/1063041","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12177","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12178","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13723","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1022727","tags":["report"]},{"url":"https://bugzilla.suse.com/1052984","tags":["report"]},{"url":"https://bugzilla.suse.com/1061107","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13721","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-13723","tags":["report"]},{"url":"http://seclists.org/oss-sec/2017/q4/31","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3453-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-13723","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-13721","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-13723","description":"In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.","status":"published","published":"2017-10-09T14:00:00Z","modified":"2024-08-05T19:05:19.958Z","updated_at":"2026-11-02T14:33:17.903346Z"}],"euvd":[{"id":"EUVD-2017-5240","description":"In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.","status":"published","published":"2017-10-09T14:00:00Z","modified":"2024-08-05T19:05:19Z","updated_at":"2026-11-03T02:23:19.185271Z"}],"ghsa":[{"id":"GHSA-w3w2-h9f5-hrg7","title":"In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to...","description":"In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.","status":"published","published":"2022-05-14T03:46:35Z","modified":"2023-02-03T05:00:34Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:52:49.021794Z"}],"nvd":[{"id":"CVE-2017-13723","description":"In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.","status":"published","published":"2017-10-10T01:30:21.407Z","modified":"2026-06-17T01:05:03.41Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:04:01.734197Z"}],"osv":[{"id":"ALPINE-CVE-2017-13723","description":"In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.","status":"published","published":"2017-10-10T01:30:21.407Z","modified":"2026-06-15T18:24:14.061002489Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-13723","title":"CVE-2017-13723 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:11.481141Z","modified":"2026-01-26T09:48:06.188736Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-13723","description":"In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.","status":"published","published":"2017-10-10T01:30:21.407Z","modified":"2026-10-20T10:47:45.693003784Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.159616Z"},{"id":"DEBIAN-CVE-2017-13723","description":"In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.","status":"published","published":"2017-10-10T01:30:21.407Z","modified":"2026-09-01T20:03:43.295410126Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-13723","description":"In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.","status":"published","published":"2017-10-09T00:00:00Z","modified":"2026-04-22T11:14:34.944297Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.122973Z"},{"id":"DLA-1186-1","title":"xorg-server - security update","status":"published","published":"2017-11-23T00:00:00Z","modified":"2026-03-09T01:01:42.199331Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4000-1","title":"xorg-server - security update","status":"published","published":"2017-10-17T00:00:00Z","modified":"2026-03-09T01:23:18.399242Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2017-0366","title":"Updated x11-server packages fix security vulnerabilities","description":"In Xext/shm, the shmseg resource id can belong to a non-existing client\nand abort X server with FatalError \"client not in use\", or overwrite\nexisting segment of another existing client (CVE-2017-13721).\n\nGenerating strings for XKB data used a single shared static buffer,\nwhich offered several opportunities for errors when strings end up\nlonger than anticipated (CVE-2017-13723).\n","status":"published","published":"2017-10-09T09:51:10Z","modified":"2026-04-16T06:23:21.112749212Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:3025-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server provides several fixes.\n\nThese security issues were fixed:\n\n- CVE-2017-13723: Prevent local DoS via unusual characters in XkbAtomText and\n  XkbStringText (bsc#1051150).\n- Improve the entropy when generating random data used in X.org server authorization\n  cookies generation by using getentropy() and getrandom() when available (bsc#1025084)\n- CVE-2017-12184,CVE-2017-12185,CVE-2017-12186,CVE-2017-12187: Fixed\n  unvalidated lengths in multiple extensions (bsc#1063034)\n- CVE-2017-12183: Fixed some unvalidated lengths in the XFIXES\n  extension. (bsc#1063035)\n- CVE-2017-12180,CVE-2017-12181,CVE-2017-12182: Fixed various unvalidated\n  lengths in the XFree86-VidMode/XFree86-DGA/XFree86-DRI extensions\n  (bsc#1063037)\n- CVE-2017-12179: Fixed an integer overflow and unvalidated length in\n  (S)ProcXIBarrierReleasePointer in Xi (bsc#1063038)\n- CVE-2017-12178: Fixed a wrong extra length check in\n  ProcXIChangeHierarchy in Xi (bsc#1063039)\n- CVE-2017-12177: Fixed an unvalidated variable-length request in\n  ProcDbeGetVisualInfo (bsc#1063040)\n- CVE-2017-12176: Fixed an unvalidated extra length in\n  ProcEstablishConnection (bsc#1063041)\n\n\n","status":"published","published":"2017-11-16T11:57:00Z","modified":"2026-02-04T02:27:55.145118Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:3047-1","title":"Security update for xorg-x11-server","description":"\n\nThis update for xorg-x11-server fixes several issues.\n\nThese security issues were fixed:\n\n- CVE-2017-13721: Missing validation of shmseg resource id in Xext/XShm\n  could lead to shared memory segments of other users beeing freed\n  (bnc#1052984)\n- CVE-2017-13723: A local denial of service via unusual characters in XkbAtomText and XkbStringText was fixed (bnc#1051150)\n- CVE-2017-12184,CVE-2017-12185,CVE-2017-12186,CVE-2017-12187: Fixed\n  unvalidated lengths in multiple extensions (bsc#1063034)\n- CVE-2017-12183: Fixed some unvalidated lengths in the XFIXES\n  extension. (bsc#1063035)\n- CVE-2017-12180,CVE-2017-12181,CVE-2017-12182: Fixed various unvalidated\n  lengths in the XFree86-VidMode/XFree86-DGA/XFree86-DRI extensions\n  (bsc#1063037)\n- CVE-2017-12179: Fixed an integer overflow and unvalidated length in\n  (S)ProcXIBarrierReleasePointer in Xi (bsc#1063038)\n- CVE-2017-12178: Fixed a wrong extra length check in\n  ProcXIChangeHierarchy in Xi (bsc#1063039)\n- CVE-2017-12177: Fixed an unvalidated variable-length request in\n  ProcDbeGetVisualInfo (bsc#1063040)\n- CVE-2017-12176: Fixed an unvalidated extra length in\n  ProcEstablishConnection (bsc#1063041)\n\n\nThese non-security issues were fixed:\n\n- Make colormap/gamma glue code work with the RandR extension disabled. This prevents it\n  from crashing and showing wrong colors. (bsc#1061107)\n- Recognize ssh as a remote client to fix launching applications remotely when using DRI3.\n  (bsc#1022727)\n","status":"published","published":"2017-11-22T16:16:29Z","modified":"2026-02-04T02:13:06.124337Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-3453-1","title":"xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial vulnerabilities","description":"Michal Srb discovered that the X.Org X server incorrectly handled shared\nmemory segments. An attacker able to connect to an X server, either locally\nor remotely, could use this issue to crash the server, or possibly replace\nshared memory segments of other X clients in the same session.\n(CVE-2017-13721)\n\nMichal Srb discovered that the X.Org X server incorrectly handled XKB\nbuffers. An attacker able to connect to an X server, either locally or\nremotely, could use this issue to crash the server, or possibly execute\narbitrary code. (CVE-2017-13723)\n","status":"published","published":"2017-10-12T14:32:14Z","modified":"2026-04-22T09:40:24.631433Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}