Vulnerability Name:

CVE-2020-14360 (CCN-192532)

Assigned:2020-12-01
Published:2020-12-01
Updated:2021-01-26
Summary:A flaw was found in the X.Org Server before version 1.20.10. An out-of-bounds access in the XkbSetMap function may lead to a privilege escalation vulnerability. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVSS v3 Severity:7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.8 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.7 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
7.8 High (REDHAT CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (REDHAT Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.1 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Complete
9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-119
Vulnerability Consequences:Gain Privileges
References:Source: MITRE
Type: CNA
CVE-2020-14360

Source: MISC
Type: Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1869139

Source: XF
Type: UNKNOWN
xorg-cve202014360-priv-esc(192532)

Source: CCN
Type: X Server GIT Repository
X Server

Source: MISC
Type: Vendor Advisory
https://lists.x.org/archives/xorg-announce/2020-December/003066.html

Source: CCN
Type: oss-sec Mailing List, Tue, 1 Dec 2020 16:16:02 +0100
X.Org server security advisory: December 1, 2020

Source: CCN
Type: IBM Security Bulletin 6493729 (Cloud Pak for Security)
Cloud Pak for Security is vulnerable to several CVEs

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2020-14360

Source: CCN
Type: ZDI-20-1420
X.Org Server XkbSetMap Out-Of-Bounds Access Privilege Escalation Vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/a:x.org:x_server:*:*:*:*:*:*:*:* (Version < 1.20.10)

    • Configuration RedHat 1:
  • cpe:/a:redhat:enterprise_linux:8:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:enterprise_linux:8::appstream:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:enterprise_linux:8::crb:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:x.org:x_server:1.20.8:*:*:*:*:*:*:*
  • AND
  • cpe:/a:ibm:cloud_pak_for_security:1.7.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:cloud_pak_for_security:1.7.2.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:8072
    P
    		xorg-x11-server-sdk-21.1.4-150500.5.1 on GA media (Moderate)
    2023-06-20
    oval:org.opensuse.security:def:7835
    P
    		xorg-x11-server-21.1.4-150500.5.1 on GA media (Moderate)
    2023-06-12
    oval:org.opensuse.security:def:688
    P
    		Security update for MozillaThunderbird (Important)
    2022-08-10
    oval:org.opensuse.security:def:94460
    P
    		 (Important)
    2022-07-06
    oval:org.opensuse.security:def:3229
    P
    		libpcap1-1.8.1-10.3.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3085
    P
    		gnome-shell-3.20.4-77.23.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3431
    P
    		apache2-mod_apparmor-2.8.2-51.18.3 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3131
    P
    		libSoundTouch0-1.7.1-5.11.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:3596
    P
    		libgcrypt20-1.6.1-16.68.1 on GA media (Moderate)
    2022-06-28
    oval:org.opensuse.security:def:94859
    P
    		xorg-x11-server-1.20.3-150400.36.7 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:94867
    P
    		zram-generator-1.1.1~git5.8612dbb-150400.1.9 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95061
    P
    		xorg-x11-server-sdk-1.20.3-150400.36.7 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95145
    P
    		python3-Twisted-22.1.0-150400.3.3 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:95226
    P
    		xorg-x11-server-wayland-1.20.3-150200.22.5.52.1 on GA media (Moderate)
    2022-06-22
    oval:org.opensuse.security:def:339
    P
    		xorg-x11-server-1.20.3-22.5.30.1 on GA media (Moderate)
    2022-06-13
    oval:org.opensuse.security:def:391
    P
    		xorg-x11-server-1.20.3-150400.36.7 on GA media (Moderate)
    2022-06-10
    oval:org.opensuse.security:def:5265
    P
    		Security update for ImageMagick (Important)
    2022-05-31
    oval:org.opensuse.security:def:101580
    P
    		Security update for python (Moderate)
    2022-04-01
    oval:org.opensuse.security:def:101858
    P
    		Security update for rust, rust1.58, rust1.59 (Moderate)
    2022-03-15
    oval:org.opensuse.security:def:113603
    P
    		xorg-x11-server-1.20.13-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:106987
    P
    		xorg-x11-server-1.20.13-1.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:1268
    P
    		Security update for the Linux Kernel (Important)
    2021-09-23
    oval:org.opensuse.security:def:96703
    P
    		libtiff-devel-4.0.9-5.27.5 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:96704
    P
    		libudisks2-0-2.6.5-3.7.2 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:96702
    P
    		libthai-data-0.1.27-1.16 on GA media (Moderate)
    2021-09-21
    oval:org.opensuse.security:def:72098
    P
    		xorg-x11-server-1.20.3-22.5.30.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:63046
    P
    		xorg-x11-server-sdk-1.20.3-22.5.30.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:72765
    P
    		xorg-x11-server-sdk-1.20.3-22.5.30.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:1957
    P
    		xorg-x11-server-sdk-1.20.3-22.5.30.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101173
    P
    		libSDL2-2_0-0-2.0.8-9.63 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:101115
    P
    		xorg-x11-server-1.20.3-22.5.30.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:62357
    P
    		xorg-x11-server-1.20.3-22.5.30.1 on GA media (Moderate)
    2021-08-09
    oval:org.opensuse.security:def:5749
    P
    		Security update for wireshark (Important)
    2021-06-22
    oval:org.opensuse.security:def:2442
    P
    		colord-1.4.2-1.37 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:5711
    P
    		Security update for python-py (Moderate)
    2021-06-01
    oval:org.opensuse.security:def:93406
    P
    		 (Moderate)
    2021-05-26
    oval:com.redhat.rhsa:def:20211804
    P
    		RHSA-2021:1804: userspace graphics, xorg-x11, and mesa security, bug fix, and enhancement update (Moderate)
    2021-05-18
    oval:com.redhat.rhsa:def:20205408
    P
    		RHSA-2020:5408: xorg-x11-server security update (Important)
    2020-12-14
    oval:org.opensuse.security:def:110355
    P
    		Security update for xorg-x11-server (Important)
    2020-12-07
    oval:org.opensuse.security:def:3850
    P
    		ant-1.9.4-3.3.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:4094
    P
    		mpfr-devel-3.1.2-7.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:5410
    P
    		Security update for xorg-x11-server (Important)
    2020-12-02
    oval:org.opensuse.security:def:110898
    P
    		Security update for xorg-x11-server (Important)
    2020-12-02
    oval:org.opensuse.security:def:5556
    P
    		Security update for xorg-x11-server (Important)
    2020-12-02
    oval:org.opensuse.security:def:2591
    P
    		Security update for xorg-x11-server (Important)
    2020-12-02
    oval:org.opensuse.security:def:104343
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:69409
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:89349
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:31079
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:57379
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:85543
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:23090
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:51078
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:96292
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:117354
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:108524
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:74562
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:90417
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:10023
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:65547
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:99897
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:33613
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:59694
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:88075
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:28854
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:55119
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:83151
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:126667
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:41076
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:44071
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:104771
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:70163
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:102964
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:64268
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:97382
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:31556
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:57822
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:86020
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:23476
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:51464
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:81015
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:117760
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:109630
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:74615
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:90688
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:10583
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:66409
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:33871
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:60141
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:88384
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:29296
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:55767
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:84072
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:127064
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:41912
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:45506
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:107839
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:73390
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:70723
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:8526
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:64437
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:97653
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:31999
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:58641
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:86463
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:23862
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:51850
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:82061
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:119770
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:38365
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:75477
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:91116
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:104072
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:10630
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:66686
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:34318
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:89091
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:29944
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:56902
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:84527
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:21345
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:46342
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:108246
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:73559
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:70770
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:9269
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:65494
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:98081
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:32818
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:59436
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:87282
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:25965
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:54677
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:82503
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:125495
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:39641
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:75754
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    BACK
    x.org x server *
    x.org x server 1.20.8
    ibm cloud pak for security 1.7.0.0
    ibm cloud pak for security 1.7.1.0
    ibm cloud pak for security 1.7.2.0