CVE-2020-14344: canonical ubuntu_linux Integer Overflow or Wraparound

CVSS: 6.7v3.1MediumModified

AliasesALPINE-CVE-2020-14344MGASA-2020-0334SUSE-SU-2020:14445-1+12 more

Published 05-08-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-14344 is a medium (CVSS 6.7) Integer Overflow or Wraparound vulnerability in canonical ubuntu_linux. EPSS estimates a 0.46% chance of exploitation in the next 30 days, higher than 38.9% of scored vulnerabilities.

Overall risk

27/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.7/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.46%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 3

OPENSUSE-SU-2024:10918-1 RHSA-2021:1804 USN-4487-1 USN-4487-2

Timeline

05-08-2020
PublishedVulnerability first disclosed.
04-08-2024
Last modifiedVulnerability information updated.

Description

An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.16.7v2.04.6

EPSS trend

Probability

0.46%

Chance of exploitation in the next 30 days

Percentile

39%

Versus all other CVEs

30-day change

0.00 pp

From 0.46% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.46%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Affected systems

Suse52 products

libX11&distro=HPE Helion OpenStack 8< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Enterprise Storage 5< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 1.6.5-3.6.2 | < 1.6.5-3.9.1
libX11&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 1.6.5-3.6.2 | < 1.6.5-3.9.1
libX11&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 1.6.5-3.6.2 | < 1.6.5-3.9.1

libX11&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 1.6.5-3.6.2 | < 1.6.5-3.9.1
libX11&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Linux Enterprise Server 12 SP2-LTSS< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Linux Enterprise Server 12 SP3-BCL< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Linux Enterprise Server 12 SP3-LTSS< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Linux Enterprise Server 12 SP5< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Linux Enterprise Server 15-LTSS< 1.6.5-3.6.2 | < 1.6.5-3.9.1
libX11&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE Linux Enterprise Server for SAP Applications 15< 1.6.5-3.6.2 | < 1.6.5-3.9.1
libX11&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE OpenStack Cloud 7< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE OpenStack Cloud 8< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE OpenStack Cloud 9< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE OpenStack Cloud Crowbar 8< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libX11&distro=SUSE OpenStack Cloud Crowbar 9< 1.6.2-12.8.1 | < 1.6.2-12.12.1
libxcb&distro=HPE Helion OpenStack 8< 1.10-4.5.1
libxcb&distro=SUSE Enterprise Storage 5< 1.10-4.5.1
libxcb&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 1.13-3.5.1
libxcb&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 1.13-3.5.1
libxcb&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 1.13-3.5.1
libxcb&distro=SUSE Linux Enterprise Module for Basesystem 15 SP2< 1.13-3.5.1
libxcb&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1< 1.13-3.5.1
libxcb&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP2< 1.13-3.5.1
libxcb&distro=SUSE Linux Enterprise Server 12 SP2-BCL< 1.10-4.5.1
libxcb&distro=SUSE Linux Enterprise Server 12 SP2-LTSS< 1.10-4.5.1
libxcb&distro=SUSE Linux Enterprise Server 12 SP3-BCL< 1.10-4.5.1
libxcb&distro=SUSE Linux Enterprise Server 12 SP3-LTSS< 1.10-4.5.1
libxcb&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 1.10-4.5.1
libxcb&distro=SUSE Linux Enterprise Server 12 SP5< 1.10-4.5.1
libxcb&distro=SUSE Linux Enterprise Server 15-LTSS< 1.13-3.5.1
libxcb&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2< 1.10-4.5.1
libxcb&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 1.10-4.5.1
libxcb&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 1.10-4.5.1
libxcb&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.10-4.5.1
libxcb&distro=SUSE Linux Enterprise Server for SAP Applications 15< 1.13-3.5.1
libxcb&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 1.10-4.5.1
libxcb&distro=SUSE OpenStack Cloud 7< 1.10-4.5.1
libxcb&distro=SUSE OpenStack Cloud 8< 1.10-4.5.1
libxcb&distro=SUSE OpenStack Cloud 9< 1.10-4.5.1
libxcb&distro=SUSE OpenStack Cloud Crowbar 8< 1.10-4.5.1
libxcb&distro=SUSE OpenStack Cloud Crowbar 9< 1.10-4.5.1
xorg-x11-libX11&distro=SUSE Linux Enterprise Point of Sale 11 SP3< 7.4-5.11.72.15.1 | < 7.4-5.11.72.18.1
xorg-x11-libX11&distro=SUSE Linux Enterprise Server 11 SP4-LTSS< 7.4-5.11.72.15.1 | < 7.4-5.11.72.18.1

Show all 52

Opensuse5 products

leapEOL15.1 | 15.2
libX11&distro=openSUSE Leap 15.1< 1.6.5-lp151.4.3.1 | < 1.6.5-lp151.4.6.1
libX11&distro=openSUSE Leap 15.2< 1.6.5-lp152.5.3.1 | < 1.6.5-lp152.5.6.1
libxcb&distro=openSUSE Leap 15.1< 1.13-lp151.4.3.1
libxcb&distro=openSUSE Leap 15.2< 1.13-lp152.5.3.1

Mageia2 products

libx11< 1.6.10-1.1.mga7
x11-proto-devel< 2018.4-4.1.mga7

Alpine1 product

libx11< 1.6.10-r0

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 18.04 | 20.04

Debian1 product

libx11< 2:1.6.10-1 | < 2:1.6.4-3+deb9u2

Fedoraproject1 product

fedoraEOL31 | 32 | 33

The x11 project1 product

libx111.6.10

Ubuntu1 product

libx11< 2:1.6.2-1ubuntu2.1+esm1 | < 2:1.6.3-1ubuntu2.2 | < 2:1.6.4-3ubuntu0.3 | < 2:1.6.9-2ubuntu1.1

X.org1 product

libx11< 1.6.10

10 vendors · 66 products

References

36 links

lists.x.org/archives/xorg-announce/2020-July/003050.htmlX Refsource MISCWEBREPORTMailing ListPatchVendor Advisory
www.openwall.com/lists/oss-security/2020/07/31/1X Refsource MISCMailing ListPatchThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14344X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00014.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00015.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00024.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2020-08/msg00031.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
security.gentoo.org/glsa/202008-18Vendor AdvisoryX Refsource GENTOOThird Party Advisory
usn.ubuntu.com/4487-1/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory

Show all 36 references

lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
usn.ubuntu.com/4487-2/Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
security.alpinelinux.org/vuln/CVE-2020-14344Advisory
advisories.mageia.org/MGASA-2020-0334.htmlAdvisory
bugs.mageia.org/show_bug.cgi?id=27030REPORT
lists.x.org/archives/xorg-announce/2019-June/002997.htmlWEB
lists.x.org/archives/xorg-announce/2019-October/003025.htmlWEB
lists.x.org/archives/xorg-announce/2020-July/003052.htmlWEB
www.suse.com/support/update/announcement/2020/suse-su-202014445-1/Advisory
bugzilla.suse.com/1174628REPORT
www.suse.com/security/cve/CVE-2020-14344WEB
www.suse.com/support/update/announcement/2020/suse-su-202014447-1/Advisory
www.suse.com/support/update/announcement/2020/suse-su-20202116-1/Advisory
www.suse.com/support/update/announcement/2020/suse-su-20202117-1/Advisory
www.suse.com/support/update/announcement/2020/suse-su-20202196-1/Advisory
www.suse.com/support/update/announcement/2020/suse-su-20202197-1/Advisory
ubuntu.com/security/CVE-2020-14344REPORT
ubuntu.com/security/notices/USN-4487-1Advisory
ubuntu.com/security/notices/USN-4487-2Advisory
www.cve.org/CVERecord?id=CVE-2020-14344REPORT
security-tracker.debian.org/tracker/CVE-2020-14344Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory
lists.opensuse.org/archives/…Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities