CVE-2017-12180

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-391 CWE-20

Affected software

Vendor	Product	Versions
The X.Org Foundation	xorg-x11-server	before 1.19.5

References

https://bugzilla.redhat.com/show_bug.cgi?id=1509221Issue Tracking, Patch, Third Party Advisory, VDB Entry
https://cgit.freedesktop.org/xorg/xserver/commit/?id=1b1d4c04695dced2463404174b50b3581dbd857bPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/11/msg00032.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201711-05Third Party Advisory, VDB Entry
https://www.debian.org/security/2017/dsa-4000Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1509221Issue Tracking, Patch, Third Party Advisory, VDB Entry
https://cgit.freedesktop.org/xorg/xserver/commit/?id=1b1d4c04695dced2463404174b50b3581dbd857bPatch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2017/11/msg00032.htmlMailing List, Third Party Advisory
https://security.gentoo.org/glsa/201711-05Third Party Advisory, VDB Entry
https://www.debian.org/security/2017/dsa-4000Third Party Advisory

Timeline

Published: Jan 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-121819.8xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash CVE-2017-121829.8xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash CVE-2017-121839.8xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or po CVE-2017-121849.8xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or CVE-2017-121859.8xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to c CVE-2017-121869.8xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash o CVE-2017-121879.8xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or po CVE-2017-121887.8arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entrie CVE-2017-121897.8It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handlin CVE-2017-12196.5IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could CVE-2017-121906.5The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/O CVE-2017-121917.4A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access