CVE-2018-14665

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2018-14665
A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.

6.6 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 0.7 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html
http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html
http://www.securityfocus.com/bid/105741 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041948 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:3410 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665 Issue Tracking Patch Third Party Advisory
https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e Patch Third Party Advisory
https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170 Patch Third Party Advisory
https://lists.x.org/archives/xorg-announce/2018-October/002927.html Mitigation Patch Vendor Advisory
https://security.gentoo.org/glsa/201810-09 Third Party Advisory
https://usn.ubuntu.com/3802-1/ Third Party Advisory
https://www.debian.org/security/2018/dsa-4328 Third Party Advisory
https://www.exploit-db.com/exploits/45697/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/45742/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/45832/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/45908/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/45922/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/45938/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/46142/ Exploit Third Party Advisory VDB Entry
https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html Exploit Third Party Advisory
http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html
http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html
http://www.securityfocus.com/bid/105741 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041948 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:3410 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665 Issue Tracking Patch Third Party Advisory
https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e Patch Third Party Advisory
https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170 Patch Third Party Advisory
https://lists.x.org/archives/xorg-announce/2018-October/002927.html Mitigation Patch Vendor Advisory
https://security.gentoo.org/glsa/201810-09 Third Party Advisory
https://usn.ubuntu.com/3802-1/ Third Party Advisory
https://www.debian.org/security/2018/dsa-4328 Third Party Advisory
https://www.exploit-db.com/exploits/45697/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/45742/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/45832/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/45908/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/45922/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/45938/ Exploit Third Party Advisory VDB Entry
https://www.exploit-db.com/exploits/46142/ Exploit Third Party Advisory VDB Entry
https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:x.org:xorg-server:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

Configuration 4 (hide)

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
History

21 Nov 2024, 03:49

Type Values Removed Values Added
References () http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html - () http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html -
References () http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html - () http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html -
References () http://www.securityfocus.com/bid/105741 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/105741 - Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1041948 - Third Party Advisory, VDB Entry () http://www.securitytracker.com/id/1041948 - Third Party Advisory, VDB Entry
References () https://access.redhat.com/errata/RHSA-2018:3410 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2018:3410 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665 - Issue Tracking, Patch, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665 - Issue Tracking, Patch, Third Party Advisory
References () https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e - Patch, Third Party Advisory () https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e - Patch, Third Party Advisory
References () https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170 - Patch, Third Party Advisory () https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170 - Patch, Third Party Advisory
References () https://lists.x.org/archives/xorg-announce/2018-October/002927.html - Mitigation, Patch, Vendor Advisory () https://lists.x.org/archives/xorg-announce/2018-October/002927.html - Mitigation, Patch, Vendor Advisory
References () https://security.gentoo.org/glsa/201810-09 - Third Party Advisory () https://security.gentoo.org/glsa/201810-09 - Third Party Advisory
References () https://usn.ubuntu.com/3802-1/ - Third Party Advisory () https://usn.ubuntu.com/3802-1/ - Third Party Advisory
References () https://www.debian.org/security/2018/dsa-4328 - Third Party Advisory () https://www.debian.org/security/2018/dsa-4328 - Third Party Advisory
References () https://www.exploit-db.com/exploits/45697/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/45697/ - Exploit, Third Party Advisory, VDB Entry
References () https://www.exploit-db.com/exploits/45742/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/45742/ - Exploit, Third Party Advisory, VDB Entry
References () https://www.exploit-db.com/exploits/45832/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/45832/ - Exploit, Third Party Advisory, VDB Entry
References () https://www.exploit-db.com/exploits/45908/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/45908/ - Exploit, Third Party Advisory, VDB Entry
References () https://www.exploit-db.com/exploits/45922/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/45922/ - Exploit, Third Party Advisory, VDB Entry
References () https://www.exploit-db.com/exploits/45938/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/45938/ - Exploit, Third Party Advisory, VDB Entry
References () https://www.exploit-db.com/exploits/46142/ - Exploit, Third Party Advisory, VDB Entry () https://www.exploit-db.com/exploits/46142/ - Exploit, Third Party Advisory, VDB Entry
References () https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html - Exploit, Third Party Advisory () https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html - Exploit, Third Party Advisory
Information

Published : 2018-10-25 20:29

Updated : 2024-11-21 03:49

NVD link : CVE-2018-14665

Mitre link : CVE-2018-14665

CVE.ORG link : CVE-2018-14665

JSON object : View

Products Affected

redhat

  • enterprise_linux_server_aus
  • enterprise_linux_server_tus
  • enterprise_linux_workstation
  • enterprise_linux_server_eus
  • enterprise_linux_desktop
  • enterprise_linux_server

debian

  • debian_linux

x.org

  • xorg-server

canonical

  • ubuntu_linux
CWE
CWE-863

Incorrect Authorization


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024