ByteOS Network

Vulnerability Details :

CVE-2018-14665

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-25 Oct, 2018 | 20:00

Updated At-05 Aug, 2024 | 09:38

A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:redhat

Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749

Published At:25 Oct, 2018 | 20:00

Updated At:05 Aug, 2024 | 09:38

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
https://www.exploit-db.com/exploits/45742/	exploit x_refsource_EXPLOIT-DB
https://lists.x.org/archives/xorg-announce/2018-October/002927.html	mailing-list x_refsource_MLIST
https://www.exploit-db.com/exploits/45922/	exploit x_refsource_EXPLOIT-DB
https://usn.ubuntu.com/3802-1/	vendor-advisory x_refsource_UBUNTU
https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e	x_refsource_CONFIRM
https://www.exploit-db.com/exploits/45697/	exploit x_refsource_EXPLOIT-DB
https://access.redhat.com/errata/RHSA-2018:3410	vendor-advisory x_refsource_REDHAT
http://www.securityfocus.com/bid/105741	vdb-entry x_refsource_BID
https://www.exploit-db.com/exploits/45908/	exploit x_refsource_EXPLOIT-DB
https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html	x_refsource_MISC
https://www.exploit-db.com/exploits/46142/	exploit x_refsource_EXPLOIT-DB
https://security.gentoo.org/glsa/201810-09	vendor-advisory x_refsource_GENTOO
http://www.securitytracker.com/id/1041948	vdb-entry x_refsource_SECTRACK
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665	x_refsource_CONFIRM
https://www.exploit-db.com/exploits/45832/	exploit x_refsource_EXPLOIT-DB
https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170	x_refsource_CONFIRM
https://www.exploit-db.com/exploits/45938/	exploit x_refsource_EXPLOIT-DB
https://www.debian.org/security/2018/dsa-4328	vendor-advisory x_refsource_DEBIAN
http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html	x_refsource_MISC
http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html	x_refsource_MISC

Hyperlink: https://www.exploit-db.com/exploits/45742/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: https://lists.x.org/archives/xorg-announce/2018-October/002927.html

Resource:

mailing-list

x_refsource_MLIST

Hyperlink: https://www.exploit-db.com/exploits/45922/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: https://usn.ubuntu.com/3802-1/

Resource:

vendor-advisory

x_refsource_UBUNTU

Hyperlink: https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e

Resource:

x_refsource_CONFIRM

Hyperlink: https://www.exploit-db.com/exploits/45697/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: https://access.redhat.com/errata/RHSA-2018:3410

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: http://www.securityfocus.com/bid/105741

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://www.exploit-db.com/exploits/45908/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html

Resource:

x_refsource_MISC

Hyperlink: https://www.exploit-db.com/exploits/46142/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: https://security.gentoo.org/glsa/201810-09

Resource:

vendor-advisory

x_refsource_GENTOO

Hyperlink: http://www.securitytracker.com/id/1041948

Resource:

vdb-entry

x_refsource_SECTRACK

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665

Resource:

x_refsource_CONFIRM

Hyperlink: https://www.exploit-db.com/exploits/45832/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170

Resource:

x_refsource_CONFIRM

Hyperlink: https://www.exploit-db.com/exploits/45938/

Resource:

exploit

x_refsource_EXPLOIT-DB

Hyperlink: https://www.debian.org/security/2018/dsa-4328

Resource:

vendor-advisory

x_refsource_DEBIAN

Hyperlink: http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html

Resource:

x_refsource_MISC

Hyperlink: http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.exploit-db.com/exploits/45742/	exploit x_refsource_EXPLOIT-DB x_transferred
https://lists.x.org/archives/xorg-announce/2018-October/002927.html	mailing-list x_refsource_MLIST x_transferred
https://www.exploit-db.com/exploits/45922/	exploit x_refsource_EXPLOIT-DB x_transferred
https://usn.ubuntu.com/3802-1/	vendor-advisory x_refsource_UBUNTU x_transferred
https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e	x_refsource_CONFIRM x_transferred
https://www.exploit-db.com/exploits/45697/	exploit x_refsource_EXPLOIT-DB x_transferred
https://access.redhat.com/errata/RHSA-2018:3410	vendor-advisory x_refsource_REDHAT x_transferred
http://www.securityfocus.com/bid/105741	vdb-entry x_refsource_BID x_transferred
https://www.exploit-db.com/exploits/45908/	exploit x_refsource_EXPLOIT-DB x_transferred
https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html	x_refsource_MISC x_transferred
https://www.exploit-db.com/exploits/46142/	exploit x_refsource_EXPLOIT-DB x_transferred
https://security.gentoo.org/glsa/201810-09	vendor-advisory x_refsource_GENTOO x_transferred
http://www.securitytracker.com/id/1041948	vdb-entry x_refsource_SECTRACK x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665	x_refsource_CONFIRM x_transferred
https://www.exploit-db.com/exploits/45832/	exploit x_refsource_EXPLOIT-DB x_transferred
https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170	x_refsource_CONFIRM x_transferred
https://www.exploit-db.com/exploits/45938/	exploit x_refsource_EXPLOIT-DB x_transferred
https://www.debian.org/security/2018/dsa-4328	vendor-advisory x_refsource_DEBIAN x_transferred
http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html	x_refsource_MISC x_transferred
http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html	x_refsource_MISC x_transferred

Hyperlink: https://www.exploit-db.com/exploits/45742/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: https://lists.x.org/archives/xorg-announce/2018-October/002927.html

Resource:

mailing-list

x_refsource_MLIST

x_transferred

Hyperlink: https://www.exploit-db.com/exploits/45922/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: https://usn.ubuntu.com/3802-1/

Resource:

vendor-advisory

x_refsource_UBUNTU

x_transferred

Hyperlink: https://gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://www.exploit-db.com/exploits/45697/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: https://access.redhat.com/errata/RHSA-2018:3410

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: http://www.securityfocus.com/bid/105741

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://www.exploit-db.com/exploits/45908/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: https://www.securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://www.exploit-db.com/exploits/46142/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: https://security.gentoo.org/glsa/201810-09

Resource:

vendor-advisory

x_refsource_GENTOO

x_transferred

Hyperlink: http://www.securitytracker.com/id/1041948

Resource:

vdb-entry

x_refsource_SECTRACK

x_transferred

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14665

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://www.exploit-db.com/exploits/45832/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: https://gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://www.exploit-db.com/exploits/45938/

Resource:

exploit

x_refsource_EXPLOIT-DB

x_transferred

Hyperlink: https://www.debian.org/security/2018/dsa-4328

Resource:

vendor-advisory

x_refsource_DEBIAN

x_transferred

Hyperlink: http://packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html

Resource:

x_refsource_MISC

x_transferred

Hyperlink: http://packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert@redhat.com

Published At:25 Oct, 2018 | 20:29

Updated At:22 Oct, 2019 | 23:15

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	6.6	MEDIUM	CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C

Type: Primary

Version: 3.0

Base score: 6.6

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.2

Base severity: HIGH

Vector:

AV:L/AC:L/Au:N/C:C/I:C/A:C

CPE Matches

X.Org Foundation

>>xorg-server>>Versions before 1.20.3(exclusive)

cpe:2.3:a:x.org:xorg-server:*:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_desktop>>7.0

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server>>7.0

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server_aus>>7.6

cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server_eus>>7.6

cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_server_tus>>7.6

cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*

Red Hat, Inc.

>>enterprise_linux_workstation>>7.0

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Canonical Ltd.

>>ubuntu_linux>>16.04

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

Canonical Ltd.

>>ubuntu_linux>>18.04

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

Canonical Ltd.

>>ubuntu_linux>>18.10

cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*

Debian GNU/Linux

>>debian_linux>>9.0

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-863	Primary	nvd@nist.gov

CWE ID: CWE-863

Type: Primary

Source: nvd@nist.gov