| Name | CVE-2014-8093 |
| Description | Multiple integer overflows in the GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to the (1) __glXDisp_ReadPixels, (2) __glXDispSwap_ReadPixels, (3) __glXDisp_GetTexImage, (4) __glXDispSwap_GetTexImage, (5) GetSeparableFilter, (6) GetConvolutionFilter, (7) GetHistogram, (8) GetMinmax, (9) GetColorTable, (10) __glXGetAnswerBuffer, (11) __GLX_GET_ANSWER_BUFFER, (12) __glXMap1dReqSize, (13) __glXMap1fReqSize, (14) Map2Size, (15) __glXMap2dReqSize, (16) __glXMap2fReqSize, (17) __glXImageSize, or (18) __glXSeparableFilter2DReqSize function, which triggers an out-of-bounds read or write. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-120-1, DSA-3095-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| xorg-server (PTS) | buster | 2:1.20.4-1+deb10u4 | fixed |
| buster (security) | 2:1.20.4-1+deb10u14 | fixed | |
| bullseye | 2:1.20.11-1+deb11u11 | fixed | |
| bullseye (security) | 2:1.20.11-1+deb11u13 | fixed | |
| bookworm | 2:21.1.7-3+deb12u5 | fixed | |
| bookworm (security) | 2:21.1.7-3+deb12u7 | fixed | |
| sid, trixie | 2:21.1.12-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| xorg-server | source | squeeze | 2:1.7.7-18+deb6u1 | DLA-120-1 | ||
| xorg-server | source | wheezy | 2:1.12.4-6+deb7u5 | DSA-3095-1 | ||
| xorg-server | source | (unstable) | 2:1.16.2.901-1 |