{"api_version":"1","generated_at":"2026-04-23T04:09:14+00:00","cve":"CVE-2014-8095","urls":{"html":"https://cve.report/CVE-2014-8095","api":"https://cve.report/api/cve/CVE-2014-8095.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-8095","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-8095"},"summary":{"title":"CVE-2014-8095","description":"The XInput extension in X.Org X Window System (aka X11 or X) X11R4 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcXChangeDeviceControl, (2) ProcXChangeDeviceControl, (3) ProcXChangeFeedbackControl, (4) ProcXSendExtensionEvent, (5) SProcXIAllowEvents, (6) SProcXIChangeCursor, (7) ProcXIChangeHierarchy, (8) SProcXIGetClientPointer, (9) SProcXIGrabDevice, (10) SProcXIUngrabDevice, (11) ProcXIUngrabDevice, (12) SProcXIPassiveGrabDevice, (13) ProcXIPassiveGrabDevice, (14) SProcXIPassiveUngrabDevice, (15) ProcXIPassiveUngrabDevice, (16) SProcXListDeviceProperties, (17) SProcXDeleteDeviceProperty, (18) SProcXIListProperties, (19) SProcXIDeleteProperty, (20) SProcXIGetProperty, (21) SProcXIQueryDevice, (22) SProcXIQueryPointer, (23) SProcXISelectEvents, (24) SProcXISetClientPointer, (25) SProcXISetFocus, (26) SProcXIGetFocus, or (27) SProcXIWarpPointer function.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2014-12-10 15:59:00","updated_at":"2023-02-13 00:42:00"},"problem_types":["CWE-119"],"metrics":[],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168694","name":"https://bugzilla.redhat.com/show_bug.cgi?id=1168694","refsource":"MISC","tags":[],"title":"1168694 – (CVE-2014-8095) CVE-2014-8095 xorg-x11-server: out of bounds access due to not validating length or offset values in XInput extension","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:119","name":"MDVSA-2015:119","refsource":"MANDRIVA","tags":[],"title":"Support / Security / Advisories /  / MDVSA-2015:119 | Mandriva","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","name":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","refsource":"CONFIRM","tags":[],"title":"Oracle Bulletin Board Update - January 2015","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://advisories.mageia.org/MGASA-2014-0532.html","name":"http://advisories.mageia.org/MGASA-2014-0532.html","refsource":"CONFIRM","tags":[],"title":"Mageia Advisory: MGASA-2014-0532 - Updated x11-server packages fix security vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/62292","name":"62292","refsource":"SECUNIA","tags":[],"title":"Security Advisory SA62292 - SUSE update for xorg-x11-server - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/","name":"http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/","refsource":"CONFIRM","tags":["Patch","Vendor Advisory"],"title":"Advisory-2014-12-09","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","name":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","refsource":"CONFIRM","tags":[],"title":"Oracle Critical Patch Update - July 2015","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/61947","name":"61947","refsource":"SECUNIA","tags":[],"title":"Security Advisory SA61947 - SUSE update for xorg-x11-server - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","name":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","refsource":"CONFIRM","tags":[],"title":"Oracle Solaris Third Party Bulletin - October 2015","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://access.redhat.com/security/cve/CVE-2014-8095","name":"https://access.redhat.com/security/cve/CVE-2014-8095","refsource":"MISC","tags":[],"title":"access.redhat.com | CVE-2014-8095","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/71599","name":"71599","refsource":"BID","tags":[],"title":"X.Org X Server Protocol Handling Multiple Out-of-Bounds Memory Access Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.debian.org/security/2014/dsa-3095","name":"DSA-3095","refsource":"DEBIAN","tags":[],"title":"Debian -- Security Information -- DSA-3095-1 xorg-server","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2014:1983","name":"https://access.redhat.com/errata/RHSA-2014:1983","refsource":"MISC","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2014:1982","name":"https://access.redhat.com/errata/RHSA-2014:1982","refsource":"MISC","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://security.gentoo.org/glsa/201504-06","name":"GLSA-201504-06","refsource":"GENTOO","tags":[],"title":"X.Org X Server: Multiple vulnerabilities  (GLSA 201504-06) — Gentoo security","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8095","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8095","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"8095","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8095","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"debian","cpe5":"debian_linux","cpe6":"7.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8095","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"x.org","cpe5":"x11","cpe6":"4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8095","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"x.org","cpe5":"x11","cpe6":"4.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"8095","vulnerable":"1","versionEndIncluding":"1.16.2.99.901","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"x.org","cpe5":"xorg-server","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2014-8095","ASSIGNER":"secalert@redhat.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"The XInput extension in X.Org X Window System (aka X11 or X) X11R4 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcXChangeDeviceControl, (2) ProcXChangeDeviceControl, (3) ProcXChangeFeedbackControl, (4) ProcXSendExtensionEvent, (5) SProcXIAllowEvents, (6) SProcXIChangeCursor, (7) ProcXIChangeHierarchy, (8) SProcXIGetClientPointer, (9) SProcXIGrabDevice, (10) SProcXIUngrabDevice, (11) ProcXIUngrabDevice, (12) SProcXIPassiveGrabDevice, (13) ProcXIPassiveGrabDevice, (14) SProcXIPassiveUngrabDevice, (15) ProcXIPassiveUngrabDevice, (16) SProcXListDeviceProperties, (17) SProcXDeleteDeviceProperty, (18) SProcXIListProperties, (19) SProcXIDeleteProperty, (20) SProcXIGetProperty, (21) SProcXIQueryDevice, (22) SProcXIQueryPointer, (23) SProcXISelectEvents, (24) SProcXISetClientPointer, (25) SProcXISetFocus, (26) SProcXIGetFocus, or (27) SProcXIWarpPointer function."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"n/a","product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_affected":"=","version_value":"n/a"}]}}]}}]}},"references":{"reference_data":[{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","refsource":"MISC","name":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html","refsource":"MISC","name":"http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html"},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","refsource":"MISC","name":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html"},{"url":"http://advisories.mageia.org/MGASA-2014-0532.html","refsource":"MISC","name":"http://advisories.mageia.org/MGASA-2014-0532.html"},{"url":"http://secunia.com/advisories/61947","refsource":"MISC","name":"http://secunia.com/advisories/61947"},{"url":"http://secunia.com/advisories/62292","refsource":"MISC","name":"http://secunia.com/advisories/62292"},{"url":"http://www.debian.org/security/2014/dsa-3095","refsource":"MISC","name":"http://www.debian.org/security/2014/dsa-3095"},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:119","refsource":"MISC","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:119"},{"url":"http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/","refsource":"MISC","name":"http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/"},{"url":"https://security.gentoo.org/glsa/201504-06","refsource":"MISC","name":"https://security.gentoo.org/glsa/201504-06"},{"url":"http://www.securityfocus.com/bid/71599","refsource":"MISC","name":"http://www.securityfocus.com/bid/71599"}]}},"nvd":{"publishedDate":"2014-12-10 15:59:00","lastModifiedDate":"2023-02-13 00:42:00","problem_types":["CWE-119"],"metrics":{"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.5},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:x.org:x11:4.0:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:x.org:xorg-server:*:*:*:*:*:*:*:*","versionEndIncluding":"1.16.2.99.901","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"8095","Ordinal":"75117","Title":"CVE-2014-8095","CVE":"CVE-2014-8095","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"8095","Ordinal":"1","NoteData":"The XInput extension in X.Org X Window System (aka X11 or X) X11R4 and X.Org Server (aka xserver and xorg-server) before 1.16.3 allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to the (1) SProcXChangeDeviceControl, (2) ProcXChangeDeviceControl, (3) ProcXChangeFeedbackControl, (4) ProcXSendExtensionEvent, (5) SProcXIAllowEvents, (6) SProcXIChangeCursor, (7) ProcXIChangeHierarchy, (8) SProcXIGetClientPointer, (9) SProcXIGrabDevice, (10) SProcXIUngrabDevice, (11) ProcXIUngrabDevice, (12) SProcXIPassiveGrabDevice, (13) ProcXIPassiveGrabDevice, (14) SProcXIPassiveUngrabDevice, (15) ProcXIPassiveUngrabDevice, (16) SProcXListDeviceProperties, (17) SProcXDeleteDeviceProperty, (18) SProcXIListProperties, (19) SProcXIDeleteProperty, (20) SProcXIGetProperty, (21) SProcXIQueryDevice, (22) SProcXIQueryPointer, (23) SProcXISelectEvents, (24) SProcXISetClientPointer, (25) SProcXISetFocus, (26) SProcXIGetFocus, or (27) SProcXIWarpPointer function.","Type":"Description","Title":null},{"CveYear":"2014","CveId":"8095","Ordinal":"2","NoteData":"2014-12-10","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"8095","Ordinal":"3","NoteData":"2016-12-30","Type":"Other","Title":"Modified"}]}}}