CVE-2020-14344: Integer Overflow
An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.
Other sources
The X Input Method (XIM) client implementation in libX11 has some integer overflows and signed/unsigned comparison issues that can lead to heap corruption when handling malformed messages from an input method.
— Red Hat
X.Org libX11 could allow a local attacker to execute arbitrary code on the system, caused by an integer overflow and signed/unsigned comparison flaws in the X Input Method (XIM) client implementation. By sending specially-crafted messages, a local attacker could exploit this vulnerability to cause a heap corruption and execute arbitrary code on the system.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2020-14344.
What is the severity level of CVE-2020-14344?
CVE-2020-14344 has a severity level of medium.
What is the affected software for CVE-2020-14344?
The affected software for CVE-2020-14344 includes X.Org libX11, Ubuntu, Red Hat, IBM Cloud Pak for Security, Fedora, Canonical Ubuntu Linux, and openSUSE Leap.
How can a local attacker exploit CVE-2020-14344?
A local attacker can exploit CVE-2020-14344 by sending specially-crafted messages to the X Input Method (XIM) client implementation.
Are there any remedies available for CVE-2020-14344?
Yes, there are remedies available for CVE-2020-14344. Please refer to the provided references for more information.