{"id":"CVE-2018-14665","aliases":["ALPINE-CVE-2018-14665","BELL-CVE-2018-14665","DEBIAN-CVE-2018-14665","DSA-4328-1","EUVD-2018-6560","GHSA-c34f-6cmx-fcvv","MGASA-2018-0421","RHSA-2018:3410","SUSE-SU-2018:3456-1","SUSE-SU-2018:3680-1","UBUNTU-CVE-2018-14665","USN-3802-1","openSUSE-SU-2024:11525-1"],"status":"published","title":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath...","description":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.","severity":{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.27241,"percentile":0.98069,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-863"],"published":"2018-10-25T00:00:00Z","modified":"2026-10-23T18:02:59Z","exploits":[{"source":"exploitdb","id":"EDB-45697","title":"xorg-x11-server \u003c 1.20.3 - Local Privilege Escalation","type":"local","platform":"multiple","date":"2018-10-25","url":"https://www.exploit-db.com/exploits/45697"},{"source":"metasploit","id":"exploit/aix/local/xorg_x11_server","title":"Xorg X11 Server Local Privilege Escalation","type":"exploit","platform":"Unix","date":"2018-10-25","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/aix/local/xorg_x11_server"},{"source":"metasploit","id":"exploit/multi/local/xorg_x11_suid_server","title":"Xorg X11 Server SUID logfile Privilege Escalation","type":"exploit","platform":"Linux,Unix","date":"2018-10-25","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/local/xorg_x11_suid_server"},{"source":"metasploit","id":"exploit/multi/local/xorg_x11_suid_server_modulepath","title":"Xorg X11 Server SUID modulepath Privilege Escalation","type":"exploit","platform":"Linux,Solaris,Unix","date":"2018-10-25","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/local/xorg_x11_suid_server_modulepath"},{"source":"pocgithub","id":"jas502n/CVE-2018-14665","title":"jas502n/CVE-2018-14665","date":"2018-10-27","url":"https://github.com/jas502n/CVE-2018-14665"},{"source":"exploitdb","id":"EDB-45742","title":"xorg-x11-server 1.20.3 - Privilege Escalation","type":"local","platform":"openbsd","date":"2018-10-30","url":"https://www.exploit-db.com/exploits/45742"},{"source":"pocgithub","id":"bolonobolo/CVE-2018-14665","title":"bolonobolo/CVE-2018-14665","date":"2018-11-02","url":"https://github.com/bolonobolo/CVE-2018-14665"},{"source":"exploitdb","id":"EDB-45832","title":"xorg-x11-server \u003c 1.20.1 - Local Privilege Escalation","type":"local","platform":"linux","date":"2018-11-13","url":"https://www.exploit-db.com/exploits/45832"},{"source":"exploitdb","id":"EDB-45908","title":"Xorg X11 Server - SUID privilege escalation (Metasploit)","type":"local","platform":"multiple","date":"2018-11-26","verified":true,"url":"https://www.exploit-db.com/exploits/45908"},{"source":"exploitdb","id":"EDB-45922","title":"xorg-x11-server \u003c 1.20.3 - 'modulepath' Local Privilege Escalation","type":"local","platform":"multiple","date":"2018-11-30","url":"https://www.exploit-db.com/exploits/45922"},{"source":"exploitdb","id":"EDB-45938","title":"Xorg X11 Server (AIX) - Local Privilege Escalation","type":"local","platform":"aix","date":"2018-12-04","url":"https://www.exploit-db.com/exploits/45938"},{"source":"exploitdb","id":"EDB-46142","title":"xorg-x11-server \u003c 1.20.3 (Solaris 11) - 'inittab Local Privilege Escalation","type":"local","platform":"solaris","date":"2019-01-14","url":"https://www.exploit-db.com/exploits/46142"},{"source":"exploitdb","id":"EDB-47701","title":"Xorg X11 Server - Local Privilege Escalation (Metasploit)","type":"local","platform":"unix","date":"2019-11-20","verified":true,"url":"https://www.exploit-db.com/exploits/47701"}],"fixes":[{"ecosystem":"Alpine:v3.10","package":"xorg-server","fixed_in":["1.20.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"xorg-server","fixed_in":["1.20.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"xorg-server","fixed_in":["1.20.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"xorg-server","fixed_in":["1.19.5-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"xorg-server","fixed_in":["1.19.5-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"xorg-server","fixed_in":["1.19.6-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"xorg-server","fixed_in":["1.20.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"xorg-server","fixed_in":["2:1.20.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xorg-server","fixed_in":["2:1.20.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xorg-server","fixed_in":["2:1.20.3-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"xorg-server","fixed_in":["2:1.19.2-1+deb9u4"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"x11-server","fixed_in":["1.19.5-1.2.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xephyr","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xorg","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-common","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-debuginfo","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xdmx","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xnest","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xvfb","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xwayland","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-devel","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-source","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xdmx","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xephyr","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xnest","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xorg","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xvfb","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xwayland","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-common","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-debuginfo","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-devel","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-source","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xephyr","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xorg","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-common","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-debuginfo","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xdmx","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xnest","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xvfb","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xwayland","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-devel","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-source","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xephyr","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xorg","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-common","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-debuginfo","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xdmx","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xnest","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xvfb","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xwayland","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-devel","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-source","fixed_in":["0:1.20.1-5.1.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xorg-x11-server","fixed_in":["7.4-27.122.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"xorg-x11-server","fixed_in":["7.4-27.122.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xorg-x11-server","fixed_in":["7.4-27.122.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"xorg-x11-server","fixed_in":["7.4-27.122.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xorg-x11-server","fixed_in":["7.4-27.122.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xorg-x11-server","fixed_in":["7.4-27.122.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"xorg-x11-server","fixed_in":["1.19.6-8.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"xorg-x11-server","fixed_in":["1.19.6-8.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"xorg-x11-server","fixed_in":["1.19.6-8.3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","fixed_in":["2:1.19.6-1ubuntu4.1~16.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"xorg-server","fixed_in":["2:1.19.6-1ubuntu4.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.3-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.2-1+deb9u4"}]}],"versions":["2:1.19.2-1","2:1.19.2-1+deb9u1","2:1.19.2-1+deb9u2","2:1.19.2-1+deb9u3"]},{"source":"osv","ecosystem":"Mageia:6","package":"x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-1.2.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xephyr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xorg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xdmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xnest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xvfb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"xorg-x11-server-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xdmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xephyr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xnest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xorg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xvfb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"xorg-x11-server-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xephyr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xorg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xdmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xnest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xvfb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"xorg-x11-server-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xephyr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xorg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xdmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xnest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xvfb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-Xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"xorg-x11-server-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.20.1-5.1.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-27.122.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-8.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-8.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-8.3.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.6-1ubuntu4.1~16.04.2"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1","2:1.18.4-1ubuntu6.1~16.04.2","2:1.19.3-1ubuntu1~16.04.2","2:1.19.3-1ubuntu1~16.04.3","2:1.19.3-1ubuntu1~16.04.4","2:1.19.5-0ubuntu2~16.04.1","2:1.19.6-1ubuntu4~16.04.1","2:1.19.6-1ubuntu4.1~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.6-1ubuntu4.2"}]}],"versions":["2:1.19.5-0ubuntu2","2:1.19.6-1ubuntu1","2:1.19.6-1ubuntu2","2:1.19.6-1ubuntu3","2:1.19.6-1ubuntu4","2:1.19.6-1ubuntu4.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.6-1ubuntu4.1~16.04.2"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1","2:1.18.4-1ubuntu6.1~16.04.2","2:1.19.3-1ubuntu1~16.04.2","2:1.19.3-1ubuntu1~16.04.3","2:1.19.3-1ubuntu1~16.04.4","2:1.19.5-0ubuntu2~16.04.1","2:1.19.6-1ubuntu4~16.04.1","2:1.19.6-1ubuntu4.1~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.19.6-1ubuntu4.2"}]}],"versions":["2:1.19.5-0ubuntu2","2:1.19.6-1ubuntu1","2:1.19.6-1ubuntu2","2:1.19.6-1ubuntu3","2:1.19.6-1ubuntu4","2:1.19.6-1ubuntu4.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.13-1.2"}]}],"bundled":28}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"x.org","product":"x_server"}],"references":[{"url":"https://www.exploit-db.com/exploits/45742/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://lists.x.org/archives/xorg-announce/2018-October/002927.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mitigation","Patch","Vendor Advisory","fix","article","report"]},{"url":"https://www.exploit-db.com/exploits/45922/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://usn.ubuntu.com/3802-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.exploit-db.com/exploits/45697/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3410","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/105741","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.exploit-db.com/exploits/45908/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://www.exploit-db.com/exploits/46142/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://security.gentoo.org/glsa/201810-09","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1041948","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://www.exploit-db.com/exploits/45832/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.exploit-db.com/exploits/45938/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.debian.org/security/2018/dsa-4328","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-14665","tags":["advisory"]},{"url":"https://www.exploit-db.com/exploits/46142"},{"url":"https://www.exploit-db.com/exploits/45938"},{"url":"https://www.exploit-db.com/exploits/45922"},{"url":"https://www.exploit-db.com/exploits/45908"},{"url":"https://www.exploit-db.com/exploits/45832"},{"url":"https://www.exploit-db.com/exploits/45742"},{"url":"https://www.exploit-db.com/exploits/45697"},{"url":"https://usn.ubuntu.com/3802-1"},{"url":"https://github.com/advisories/GHSA-c34f-6cmx-fcvv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-14665","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-14665","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-14665","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0421.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23757","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2018/10/25/1","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1637761","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3410.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-14665","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-14665","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183456-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1078383","tags":["report"]},{"url":"https://bugzilla.suse.com/1111697","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14665","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183680-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1112020","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-14665","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3802-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-1003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-0006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1377","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12176","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3472","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-14665","description":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.","status":"published","published":"2018-10-25T20:00:00Z","modified":"2024-08-05T09:38:13Z","updated_at":"2026-11-02T14:35:00.948726Z"}],"euvd":[{"id":"EUVD-2018-6560","description":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.","status":"published","published":"2018-10-25T20:00:00Z","modified":"2024-08-05T09:38:13Z","updated_at":"2026-11-03T02:39:46.259365Z"}],"ghsa":[{"id":"GHSA-c34f-6cmx-fcvv","title":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath...","description":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.","status":"published","published":"2022-05-13T01:31:03Z","modified":"2025-08-29T15:31:44Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:03:27.292795Z"}],"nvd":[{"id":"CVE-2018-14665","description":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.","status":"published","published":"2018-10-25T20:29:00.25Z","modified":"2026-06-17T01:41:24.593Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:04:46.409324Z"}],"osv":[{"id":"ALPINE-CVE-2018-14665","description":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.","status":"published","published":"2018-10-25T20:29:00.25Z","modified":"2026-10-23T17:24:01.220061658Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-14665","title":"CVE-2018-14665 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:49.218459Z","modified":"2026-01-26T09:46:50.424657Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-14665","description":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.","status":"published","published":"2018-10-25T20:29:00.25Z","modified":"2026-10-20T13:46:35.030707289Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-14665","description":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.","status":"published","published":"2018-10-25T20:29:00.25Z","modified":"2026-10-23T18:02:59.886141445Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"RHSA-2018:3410","title":"Red Hat Security Advisory: xorg-x11-server security update","status":"published","published":"2024-09-16T01:49:45Z","modified":"2026-06-26T12:22:07.605169211Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-14665","description":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.","status":"published","published":"2018-10-25T00:00:00Z","modified":"2026-04-22T11:45:49.064055Z","cvss":[{"version":"3.0","score":6.6,"vector":"CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"DSA-4328-1","title":"xorg-server - security update","status":"published","published":"2018-10-25T00:00:00Z","modified":"2026-03-09T02:10:51.711474Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0421","title":"Updated x11-server packages fix security vulnerability","description":"A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission\ncheck for -modulepath and -logfile options when starting Xorg. X server\nallows unprivileged users with the ability to log in to the system via\nphysical console to escalate their privileges and run arbitrary code under\nroot privileges (CVE-2018-14665).\n","status":"published","published":"2018-10-27T09:45:46Z","modified":"2026-04-16T06:26:04.464123011Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11525-1","title":"xorg-x11-server-1.20.13-1.2 on GA media","description":"These are all security issues fixed in the xorg-x11-server-1.20.13-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:38:03.434329Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:3456-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server provides the following fix:\n\nSecurity issue fixed:\n\n- CVE-2018-14665: Local attackers could overwrite system files in any directory using the -logfile option and gain privileges (bsc#1111697)\n\nNon security issues fixed:\n\n- Do not write past the allocated buffer. (bsc#1078383)\n","status":"published","published":"2018-10-25T14:42:13Z","modified":"2026-02-04T04:18:44.35934Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"SUSE-SU-2018:3680-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2018-14665: Disable -logfile and -modulepath when running with elevated privileges (bsc#1112020, \n\n  Note that SUSE by default does not run with elevated privileges, so the default installation\n  is not affected by this problem.\n","status":"published","published":"2018-11-08T16:54:31Z","modified":"2026-02-04T02:27:46.885913Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3802-1","title":"xorg-server, xorg-server-hwe-16.04 vulnerability","description":"Narendra Shinde discovered that the X.Org X server incorrectly handled\ncertain command line parameters when running as root with the legacy\nwrapper. When certain graphics drivers are being used, a local attacker\ncould possibly use this issue to overwrite arbitrary files and escalate\nprivileges.\n","status":"published","published":"2018-10-26T14:29:46Z","modified":"2026-04-22T09:51:57.772998Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}