Vulnerability in libxxf86vm package - Integer overflows, buffer overflows, and memory corruption
Summary
DSA-2692-1: libxxf86vm - several. Affects libxxf86vm versions < 1:1.1.2-1+deb7u1. Fixed in 1:1.1.2-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libxxf86vm package is a component of the X.org graphics stack and related libraries. It provides an interface to the XFree86-VidModeExtension extension, allowing applications to query and set video modes on X servers. The package is commonly used in Debian 6.0 (squeeze) and Debian 7 (wheezy) distributions.
Vulnerability Detail
Multiple security issues have been discovered in the libxxf86vm package. These include integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption, and missing input sanitizing. These vulnerabilities could potentially lead to privilege escalation or denial of service attacks. The specific details of the vulnerabilities can be found in the Debian Security Advisory DSA-2692-1.
How To Fix
Minimum fixed version
1:1.1.2-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libxxf86vmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no mentioned workarounds for these vulnerabilities.
Conclusion
The libxxf86vm package in Debian 6.0 (squeeze) and Debian 7 (wheezy) distributions is vulnerable to multiple security issues. It is recommended to upgrade the package to the fixed versions to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libxxf86vm →
FAQ
These vulnerabilities could potentially allow an attacker to escalate their privileges or cause denial of service on systems using the libxxf86vm package.
The vulnerabilities affect the libxxf86vm package in Debian 6.0 (squeeze) and Debian 7 (wheezy) distributions.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your package-lock.json file and the playground will provide real-time alerts for open-source vulnerabilities.
Yes, fixed versions of the libxxf86vm package are available. For Debian 6.0 (squeeze), the fixed version is 1:1.1.0-2+squeeze1. For Debian 7 (wheezy), the fixed version is 1:1.1.2-1+deb7u1.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-2692-1.
Related vulnerabilities
Recent vulnerabilities recorded for libxxf86vm.
