CVE-2020-14347

CVE	CVE-2020-14347
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-08-05 14:15:00 UTC
Updated	2023-11-07 03:17:00 UTC
Description	A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable.

Problem Types: CWE-665

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Canonical	Ubuntu Linux	14.04	All	All	All
Operating System	Canonical	Ubuntu Linux	16.04	All	All	All
Operating System	Canonical	Ubuntu Linux	18.04	All	All	All
Operating System	Canonical	Ubuntu Linux	20.04	All	All	All
Operating System	Debian	Debian Linux	10.0	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Application	X.org	Xorg-server	All	All	All	All
Application	X.org	Xorg-server	All	All	All	All

Reference	Source	Link	Tags
USN-4488-2: X.Org X Server vulnerabilities \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com
[security-announce] openSUSE-SU-2020:1279-1: important: Security update	SUSE	lists.opensuse.org
X.Org security advisory: July 31, 2020: Xserver	MISC	lists.x.org	Mailing List, Patch, Vendor Advisory
[SECURITY] [DLA 2359-1] xorg-server security update	MLIST	lists.debian.org
USN-4488-1: X.Org X Server vulnerabilities \| Ubuntu security notices \| Ubuntu	UBUNTU	usn.ubuntu.com
1862258 – (CVE-2020-14347) CVE-2020-14347 xorg-x11-server: leak of uninitialized heap memory from the X server to clients in AllocatePixmap of dix/pixmap.c	CONFIRM	bugzilla.redhat.com	Issue Tracking, Third Party Advisory
Debian -- Security Information -- DSA-4758-1 xorg-server	DEBIAN	www.debian.org
[security-announce] openSUSE-SU-2020:1302-1: important: Security update	SUSE	lists.opensuse.org
X.Org X Server: Multiple vulnerabilities (GLSA 202012-01) — Gentoo security	GENTOO	security.gentoo.org
oss-security - Fwd: X.Org security advisory: July 31, 2020: Xserver	MISC	www.openwall.com	Mailing List, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

159217 Oracle Enterprise Linux Security Update for userspace graphics, xorg-x11, and mesa (ELSA-2021-1804)
239300 Red Hat Update for userspace graphics, xorg-x11, and mesa (RHSA-2021:1804)
377052 Alibaba Cloud Linux Security Update for xorg-x11-server (ALINUX2-SA-2020:0192)
377380 Alibaba Cloud Linux Security Update for userspace graphics, xorg-x11, and mesa (ALINUX3-SA-2022:0087)
377568 Alibaba Cloud Linux Security Update for userspace graphics, xorg-x11, and mesa (ALINUX3-SA-2022:0114)
500825 Alpine Linux Security Update for xorg-server
690478 Free Berkeley Software Distribution (FreeBSD) Security Update for xorg-server (3c7ba82a-d3fb-11ea-9aba-0c9d925bbbc0)
730228 McAfee Web Gateway Multiple Vulnerabilities (WP-3445, WP-3483, WP-3527, WP-3528, WP-3547, WP-3584,WP-3589,WP-3611)
940098 AlmaLinux Security Update for userspace (ALSA-2021:1804)
960449 Rocky Linux Security Update for userspace (RLSA-2021:1804)