Bug 1216020 (CVE-2015-3418) - CVE-2015-3418 xorg-x11-server: divide-by-zero when checking image dimensions
Summary: CVE-2015-3418 xorg-x11-server: divide-by-zero when checking image dimensions
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2015-3418
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1170917 1216022 1217471
Blocks: 1216021
TreeView+ depends on / blocked
 
Reported: 2015-04-28 11:41 UTC by Martin Prpič
Modified: 2021-10-21 00:45 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A divide-by-zero flaw was found in the way the X.Org server checked the dimensions of certain images. An attacker could potentially crash the X.Org server by tricking a suitable X application into displaying a specially crafted image file.
Clone Of:
Environment:
Last Closed: 2021-10-21 00:45:04 UTC


Attachments (Terms of Use)

Description Martin Prpič 2015-04-28 11:41:05 UTC
A divide-by-zero flaw was found in the way the X.Org server checked the dimensions of certain images. An attacker may be able to crash the X.Org server by tricking a suitable X application into displaying a specially crafted image file.

This was introduced by the fix for the CVE-2014-8092 issue.

Upstream patch:

http://cgit.freedesktop.org/xorg/xserver/commit/?id=dc777c346d5d452a53b13b917c45f6a1bad2f20b

Comment 1 Martin Prpič 2015-04-28 11:42:36 UTC
Created xorg-x11-server tracking bugs for this issue:

Affects: fedora-all [bug 1216022]

Comment 2 Stefan Cornelius 2015-04-30 08:02:29 UTC
Although a malicious authenticated client could exploit this flaw to crash the X.Org server, this does not really cross any security boundaries, as X.Org provides other, intended mechanisms with the same effect. Additionally, the impact of this flaw is limited to a crash only; it should not be possible to gain elevated privileges by exploiting this problem.

However, it might be possible for a legitimate application to open an attacker-provided image with height 0, which is then passed all the way down to the vulnerable X.Org function, where height 0 may trigger the divide-by-zero, ultimately crashing the X.Org server.

I've tried to crash my X.Org server, but so far I could not find a suitable vector.

Comment 3 Stefan Cornelius 2015-04-30 08:09:51 UTC
Statement:

This issue affects the versions of xorg-x11-server as shipped with Red Hat Enterprise Linux 5 and 7. Red Hat Product Security has rated this issue as having Low security impact. A future update may address this issue for Red Hat Enterprise Linux 7.

Red Hat Enterprise Linux 5 is now in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates.

Comment 5 Huzaifa S. Sidhpurwala 2015-07-27 04:44:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHBA-2015-1445 https://rhn.redhat.com/errata/RHBA-2015-1445.html


Note You need to log in before you can comment on or make changes to this bug.