CVE-2020-14363: Integer Overflow
An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an application compiled with libX11 to crash, or in some cases, result in arbitrary code execution. The highest threat from this flaw is to confidentiality, integrity as well as system availability.
Other sources
There is an integer overflow and a double free vulnerability in the way LibX11 handles locales. The integer overflow is a necessary precursor to the double free.
— Red Hat
X.Org libX11 is vulnerable to a denial of service, caused by a double free in the way LibX11 handles locales. By persuading a victim to open a specially crafted file, a remote attacker could exploit this vulnerability to cause the application to crash.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-14363?
CVE-2020-14363 is a vulnerability in X.Org libX11 that can be exploited by a local privileged attacker to crash an application or execute arbitrary code.
What is the severity of CVE-2020-14363?
The severity of CVE-2020-14363 is high with a CVSS score of 7.8.
How does CVE-2020-14363 affect X.Org libX11?
CVE-2020-14363 affects X.Org libX11 by causing a denial of service or allowing arbitrary code execution.
Which software versions are affected by CVE-2020-14363?
The affected software versions include libX11 2:1.6.7-1+deb10u2, 2:1.6.7-1+deb10u4, 2:1.7.2-1+deb11u1, 2:1.7.2-1+deb11u2, 2:1.8.4-2+deb12u1, 2:1.8.4-2+deb12u2, and 2:1.8.7-1.
How can I fix CVE-2020-14363?
To fix CVE-2020-14363, update your libX11 software to versions 2:1.6.7-1+deb10u2, 2:1.6.7-1+deb10u4, 2:1.7.2-1+deb11u1, 2:1.7.2-1+deb11u2, 2:1.8.4-2+deb12u1, 2:1.8.4-2+deb12u2, or 2:1.8.7-1.