Nixpkgs Security Tracker

CVE-2024-31083

7.8 HIGH

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): HIGH

created 5 months, 1 week ago

Xorg-x11-server: use-after-free in procrenderaddglyphs

A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request.

Affected products

tigervnc

*

xorg-x11-server

==21.1.12
*

xorg-x11-server-Xwayland

*

Matching in nixpkgs

pkgs.tigervnc

Fork of tightVNC, made in cooperation with VirtualGL

nixos-25.05 ???
- nixos-25.05-small 1.14.0
nixos-unstable 1.15.0
- nixos-unstable-small 1.15.0
- nixpkgs-unstable 1.14.0

CVE-2024-31081

7.3 HIGH

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): LOW
Availability impact (A): HIGH

created 5 months, 1 week ago

Xorg-x11-server: heap buffer overread/data leakage in procxipassivegrabdevice

A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.

Affected products

tigervnc

*

xorg-server

==1.7.0

xorg-x11-server

*

xorg-x11-server-Xwayland

*

Matching in nixpkgs

pkgs.tigervnc

Fork of tightVNC, made in cooperation with VirtualGL

nixos-25.05 ???
- nixos-25.05-small 1.14.0
nixos-unstable 1.15.0
- nixos-unstable-small 1.15.0
- nixpkgs-unstable 1.14.0

pkgs.xorg.xvfb

nixos-25.05 ???
- nixos-25.05-small 21.1.16
nixos-unstable 21.1.14
- nixos-unstable-small 21.1.16
- nixpkgs-unstable 21.1.16

pkgs.xorg.xorgserver

nixos-25.05 ???
- nixos-25.05-small 21.1.16
nixos-unstable 21.1.14
- nixos-unstable-small 21.1.16
- nixpkgs-unstable 21.1.16

CVE-2020-25720

7.5 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): HIGH
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): HIGH

created 5 months, 1 week ago

Samba: check attribute access rights for ldap adds of computers

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.

Affected products

rhcos

samba

<4.17.8

samba4