{"id":"CVE-2020-25697","aliases":["EUVD-2020-18358","GHSA-qrj9-jg63-p8hg","SUSE-SU-2023:3189-1","SUSE-SU-2023:3190-1","UBUNTU-CVE-2020-25697","openSUSE-SU-2024:12993-1"],"status":"published","title":"A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for...","description":"A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00313,"percentile":0.24417,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306"],"published":"2021-05-26T12:08:12Z","modified":"2026-10-12T20:15:05Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xtrans","fixed_in":["1.3.5-5.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xtrans","fixed_in":["1.3.5-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xtrans","fixed_in":["1.3.5-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"xtrans","fixed_in":["1.3.5-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"xtrans","fixed_in":["1.3.5-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"xtrans","fixed_in":["1.3.5-150000.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xtrans","fixed_in":["1.5.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xtrans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-5.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xtrans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xtrans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"xtrans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xtrans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xtrans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5-150000.3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"libx11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.6.1-1ubuntu1","2:1.6.1-1ubuntu2","2:1.6.2-1ubuntu1","2:1.6.2-1ubuntu2","2:1.6.2-1ubuntu2.1","2:1.6.2-1ubuntu2.1+esm1","2:1.6.2-1ubuntu2.1+esm2","2:1.6.2-1ubuntu2.1+esm3","2:1.6.2-1ubuntu2.1+esm4","2:1.6.2-1ubuntu2.1+esm5","2:1.6.2-1ubuntu2.1+esm6"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"libx11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.6.3-1ubuntu2","2:1.6.3-1ubuntu2.1","2:1.6.3-1ubuntu2.2","2:1.6.3-1ubuntu2.2+esm1","2:1.6.3-1ubuntu2.2+esm2","2:1.6.3-1ubuntu2.2+esm3","2:1.6.3-1ubuntu2.2+esm4","2:1.6.3-1ubuntu2.2+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"libx11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.6.4-3","2:1.6.4-3ubuntu0.1","2:1.6.4-3ubuntu0.2","2:1.6.4-3ubuntu0.3","2:1.6.4-3ubuntu0.4","2:1.6.4-3ubuntu0.4+esm1","2:1.6.4-3ubuntu0.4+esm2","2:1.6.4-3ubuntu0.4+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libx11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.6.8-1","2:1.6.9-2","2:1.6.9-2ubuntu1","2:1.6.9-2ubuntu1.1","2:1.6.9-2ubuntu1.2","2:1.6.9-2ubuntu1.5","2:1.6.9-2ubuntu1.6","2:1.6.9-2ubuntu1.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libx11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.7.2-1","2:1.7.2-2","2:1.7.2-2build1","2:1.7.5-1","2:1.7.5-1ubuntu0.2","2:1.7.5-1ubuntu0.3","2:1.7.5-1ubuntu0.4"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xtrans","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0-1.1"}]}]}],"products":[{"vendor":"the xorg project","product":"xorg-x11-server"},{"vendor":"x.org","product":"x_server"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2020/11/09/3","tags":["mailing-list","x_refsource_MLIST","x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://seclists.org/oss-sec/2020/q4/105","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1895295","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25697"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1895295,"},{"url":"https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E"},{"url":"http://www.openwall.com/lists/oss-security/2020/11/09/3,"},{"url":"https://github.com/advisories/GHSA-qrj9-jg63-p8hg"},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233189-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1178613","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25697","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233190-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-25697","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/11/09/3","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25697","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-25697","description":"A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.","status":"published","published":"2021-05-26T12:08:12Z","modified":"2024-08-04T15:40:36.622Z","cwes":["CWE-306"],"updated_at":"2026-11-02T14:35:48.854892Z"}],"euvd":[{"id":"EUVD-2020-18358","description":"A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.","status":"published","published":"2021-05-26T12:08:12Z","modified":"2024-08-04T15:40:36Z","updated_at":"2026-11-03T03:07:16.74035Z"}],"ghsa":[{"id":"GHSA-qrj9-jg63-p8hg","title":"A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for...","description":"A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.","status":"published","published":"2022-05-24T19:03:21Z","modified":"2023-02-13T00:30:52Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:54:04.926808Z"}],"nvd":[{"id":"CVE-2020-25697","description":"A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.","status":"published","published":"2021-05-26T13:15:07.6Z","modified":"2026-06-17T03:07:08.923Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:06:43.288951Z"}],"osv":[{"id":"UBUNTU-CVE-2020-25697","description":"A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.","status":"published","published":"2021-05-26T13:15:00Z","modified":"2026-10-12T20:15:05.065102122Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"openSUSE-SU-2024:12993-1","title":"xtrans-1.5.0-1.1 on GA media","description":"These are all security issues fixed in the xtrans-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:32:07.287334Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:3189-1","title":"Security update for xtrans","description":"This update for xtrans fixes the following issues:\n\n- CVE-2020-25697: Fixed local privilege escalation via TRANS_ABSTRACT on the client side (bsc#1178613).\n","status":"published","published":"2023-08-03T20:56:57Z","modified":"2026-02-04T04:15:58.662394Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2023:3190-1","title":"Security update for xtrans","description":"This update for xtrans fixes the following issues:\n\n- CVE-2020-25697: Fixed local privilege escalation via TRANS_ABSTRACT on the client side (bsc#1178613).\n","status":"published","published":"2023-08-03T20:57:29Z","modified":"2025-05-02T04:30:40.242863Z","updated_at":"2026-11-02T15:53:53.019382Z"}]}}