{"id":"CVE-2017-2624","aliases":["DEBIAN-CVE-2017-2624","DLA-1186-1","EUVD-2017-11785","GHSA-6pw7-qhf8-rjff","MGASA-2017-0269","MGASA-2018-0200","SUSE-SU-2017:1675-1","UBUNTU-CVE-2017-2624","USN-3362-1","openSUSE-SU-2024:11525-1"],"status":"published","title":"It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT...","description":"It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.00697,"percentile":0.5331,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-385"],"published":"2017-03-01T00:00:00Z","modified":"2026-10-20T13:21:51Z","fixes":[{"ecosystem":"Debian:12","package":"xorg-server","fixed_in":["2:1.19.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xorg-server","fixed_in":["2:1.19.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xorg-server","fixed_in":["2:1.19.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"nx","fixed_in":["3.5.0.33-1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"xorg-x11-server","fixed_in":["7.6_1.18.3-71.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"xorg-x11-server","fixed_in":["7.6_1.18.3-71.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"xorg-x11-server","fixed_in":["7.6_1.18.3-71.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"xorg-x11-server","fixed_in":["7.6_1.18.3-71.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xorg-x11-server","fixed_in":["7.6_1.18.3-71.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","fixed_in":["2:1.15.1-0ubuntu2.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","fixed_in":["2:1.18.3-1ubuntu2.3~trusty2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","fixed_in":["2:1.18.4-0ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","fixed_in":["2:1.18.4-1ubuntu6.1~16.04.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.2-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.12.4-6+deb7u8"}]}],"versions":["2:1.12.4-6","2:1.12.4-6+deb7u1","2:1.12.4-6+deb7u2","2:1.12.4-6+deb7u3","2:1.12.4-6+deb7u4","2:1.12.4-6+deb7u5","2:1.12.4-6+deb7u6","2:1.12.4-6+deb7u7"],"bundled":11},{"source":"osv","ecosystem":"Mageia:5","package":"x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.4-2.2.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"nx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0.33-1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-71.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-71.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-71.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-71.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6_1.18.3-71.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.15.1-0ubuntu2.9"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.3-1ubuntu2.3~trusty2"}]}],"versions":["2:1.18.3-1ubuntu2.2~trusty1","2:1.18.3-1ubuntu2.2~trusty2","2:1.18.3-1ubuntu2.2~trusty3","2:1.18.3-1ubuntu2.3~trusty1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-0ubuntu0.3"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-1ubuntu6.1~16.04.2"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.15.1-0ubuntu2.9"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"xorg-server-lts-xenial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.3-1ubuntu2.3~trusty2"}]}],"versions":["2:1.18.3-1ubuntu2.2~trusty1","2:1.18.3-1ubuntu2.2~trusty2","2:1.18.3-1ubuntu2.2~trusty3","2:1.18.3-1ubuntu2.3~trusty1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-0ubuntu0.3"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.18.4-1ubuntu6.1~16.04.2"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.13-1.2"}]}],"bundled":28}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"the xorg project","product":"xorg-x11-server"},{"vendor":"x.org","product":"x_server"},{"vendor":"xorg","product":"xorg-x11-server"}],"references":[{"url":"https://security.gentoo.org/glsa/201704-03","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/commit/d7ac755f0b618eb1259d93c8a16ec6e39a18627c","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"http://www.securitytracker.com/id/1037919","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201710-30","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/96480","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2624","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2624"},{"url":"https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg"},{"url":"https://github.com/advisories/GHSA-6pw7-qhf8-rjff"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-2624","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0269.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21191","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-06/msg00070.html","tags":["web"]},{"url":"https://usn.ubuntu.com/usn/usn-3362-1/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0200.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22734","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JSPXW5WCJM4QIBQVMB3FWB7BP2LWAL45/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171675-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1019649","tags":["report"]},{"url":"https://bugzilla.suse.com/1021803","tags":["report"]},{"url":"https://bugzilla.suse.com/1025029","tags":["report"]},{"url":"https://bugzilla.suse.com/1025035","tags":["report"]},{"url":"https://bugzilla.suse.com/1025084","tags":["report"]},{"url":"https://bugzilla.suse.com/1025985","tags":["report"]},{"url":"https://bugzilla.suse.com/1032509","tags":["report"]},{"url":"https://bugzilla.suse.com/1039042","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2624","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-2624","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2017/03/01/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3362-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2624","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-10971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-10972","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14665","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3472","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-2624","description":"It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.","status":"published","published":"2018-07-27T18:00:00Z","modified":"2024-08-05T14:02:06.893Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-385"],"updated_at":"2026-11-02T14:33:15.543086Z"}],"euvd":[{"id":"EUVD-2017-11785","description":"It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.","status":"published","published":"2018-07-27T18:00:00Z","modified":"2024-08-05T14:02:06Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:20.499267Z"}],"ghsa":[{"id":"GHSA-6pw7-qhf8-rjff","title":"It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT...","description":"It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.","status":"published","published":"2022-05-13T01:36:52Z","modified":"2025-08-29T15:31:38Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-200","CWE-385"],"updated_at":"2026-11-02T15:03:27.292795Z"}],"nvd":[{"id":"CVE-2017-2624","description":"It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.","status":"published","published":"2018-07-27T18:29:00.827Z","modified":"2026-06-17T01:16:32.113Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":1.9,"vector":"AV:L/AC:M/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-385","CWE-200"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"CVE-2017-2624","description":"It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.","status":"published","published":"2018-07-27T18:29:00.827Z","modified":"2026-10-20T13:21:51.359720517Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-2624","description":"It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.","status":"published","published":"2018-07-27T18:29:00.827Z","modified":"2026-09-01T20:03:47.776869517Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-2624","description":"It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies. If the cookie is correct, it is allowed to attach to the Xorg session. Since most memcmp() implementations return after an invalid byte is seen, this causes a time difference between a valid and invalid byte, which could allow an efficient brute force attack.","status":"published","published":"2017-03-01T00:00:00Z","modified":"2026-04-22T11:22:51.914108Z","cvss":[{"version":"3.0","score":7,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"DLA-1186-1","title":"xorg-server - security update","status":"published","published":"2017-11-23T00:00:00Z","modified":"2026-03-09T01:01:42.199331Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2017-0269","title":"Updated x11-server packages fix security vulnerabilities","description":"Eric Sesterhenn discovered that the X.Org X server incorrectly compared\nMIT cookies. An attacker could possibly use this issue to perform a\ntiming attack and recover the MIT cookie (CVE-2017-2624).\n\nIt was discovered that the X.Org X server incorrectly handled endianness\nconversion of certain X events. An attacker able to connect to an X\nserver, either locally or remotely, could use this issue to crash the\nserver, or possibly execute arbitrary code as an administrator\n(CVE-2017-10971).\n\nIt was discovered that the X.Org X server incorrectly handled endianness\nconversion of certain X events. An attacker able to connect to an X\nserver, either locally or remotely, could use this issue to possibly\nobtain sensitive information (CVE-2017-10972).\n\nUse-after-free issue in an unused function in XDM (boo#1025035).\n","status":"published","published":"2017-08-15T09:57:10Z","modified":"2026-04-16T06:25:08.581672408Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"MGASA-2018-0200","title":"Updated nxagent packages fix security vulnerability","description":"CVE-2017-2624: Timing attack against MIT Cookie\n","status":"published","published":"2018-04-13T20:08:48Z","modified":"2026-04-16T06:24:40.698549083Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11525-1","title":"xorg-x11-server-1.20.13-1.2 on GA media","description":"These are all security issues fixed in the xorg-x11-server-1.20.13-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:38:03.434329Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:1675-1","title":"Security update for xorg-x11-server","description":"\nThis update for xorg-x11-server provides the following fixes:\n\n- Remove unused function with use-after-free issue. (bsc#1025035)\n- Use arc4random to generate cookies. (bsc#1025084)\n- Prevent timing attack against MIT cookie. (bsc#1025029, CVE-2017-2624)\n- XDrawArc performance improvement. (bsc#1019649)\n- Re-enable indirect GLX by default. (bsc#1039042)\n- Add IndirectGLX ServerFlags option which allows users to enable or disable indirect GLX. (bsc#1032509)\n- Fix dashing in GLAMOR. (bsc#1021803)\n- Fix X server crash on drawing dashed lines. (bsc#1025985)\n","status":"published","published":"2017-06-26T08:22:49Z","modified":"2026-02-04T03:08:01.160489Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3362-1","title":"xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial vulnerabilities","description":"It was discovered that the X.Org X server incorrectly handled endianness\nconversion of certain X events. An attacker able to connect to an X server,\neither locally or remotely, could use this issue to crash the server, or\npossibly execute arbitrary code as an administrator. (CVE-2017-10971)\n\nIt was discovered that the X.Org X server incorrectly handled endianness\nconversion of certain X events. An attacker able to connect to an X server,\neither locally or remotely, could use this issue to possibly obtain\nsensitive information. (CVE-2017-10972)\n\nEric Sesterhenn discovered that the X.Org X server incorrectly compared\nMIT cookies. An attacker could possibly use this issue to perform a timing\nattack and recover the MIT cookie. (CVE-2017-2624)\n","status":"published","published":"2017-07-24T16:37:00Z","modified":"2026-04-22T09:37:27.964037Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}