VulnerabilityModified

CVE-2013-7439

Multiple off-by-one errors in the (1) MakeBigReq and (2) SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11 before 1.6.0 allow remote attackers to have unspecified impact via a crafted request, which triggers a buffer overflow.

HIGH 7.5EPSS 4.25%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.25%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 2.0: 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS: 4.25% probability · 90th percentile
CISA KEV: Not listed
Weakness: CWE-189
Affected: x.org/libx11 · canonical/ubuntu linux · debian/debian linux · x.org/x11
Source: security@ubuntu.com

References

http://lists.x.org/archives/xorg-announce/2015-April/002561.htmlPatch, Vendor Advisory
http://seclists.org/oss-sec/2015/q2/81Third Party Advisory, VDB Entry
http://www.debian.org/security/2015/dsa-3224Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
http://www.securityfocus.com/bid/73962Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2568-1Third Party Advisory
https://bugs.freedesktop.org/show_bug.cgi?id=56508Issue Tracking
http://lists.x.org/archives/xorg-announce/2015-April/002561.htmlPatch, Vendor Advisory
http://seclists.org/oss-sec/2015/q2/81Third Party Advisory, VDB Entry
http://www.debian.org/security/2015/dsa-3224Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
http://www.securityfocus.com/bid/73962Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2568-1Third Party Advisory
https://bugs.freedesktop.org/show_bug.cgi?id=56508Issue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.