Red Hat Bugzilla – Bug 1216020
CVE-2015-3418 xorg-x11-server: divide-by-zero when checking image dimensions
Last modified: 2016-07-28 09:54:28 EDT
A divide-by-zero flaw was found in the way the X.Org server checked the dimensions of certain images. An attacker may be able to crash the X.Org server by tricking a suitable X application into displaying a specially crafted image file. This was introduced by the fix for the CVE-2014-8092 issue. Upstream patch: http://cgit.freedesktop.org/xorg/xserver/commit/?id=dc777c346d5d452a53b13b917c45f6a1bad2f20b
Created xorg-x11-server tracking bugs for this issue: Affects: fedora-all [bug 1216022]
Although a malicious authenticated client could exploit this flaw to crash the X.Org server, this does not really cross any security boundaries, as X.Org provides other, intended mechanisms with the same effect. Additionally, the impact of this flaw is limited to a crash only; it should not be possible to gain elevated privileges by exploiting this problem. However, it might be possible for a legitimate application to open an attacker-provided image with height 0, which is then passed all the way down to the vulnerable X.Org function, where height 0 may trigger the divide-by-zero, ultimately crashing the X.Org server. I've tried to crash my X.Org server, but so far I could not find a suitable vector.
Statement: This issue affects the versions of xorg-x11-server as shipped with Red Hat Enterprise Linux 5 and 7. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue for Red Hat Enterprise Linux 7. Red Hat Enterprise Linux 5 is now in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates.
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHBA-2015-1445 https://rhn.redhat.com/errata/RHBA-2015-1445.html