CVE-2017-12187

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-391CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jan 24, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-121887.8arch/x86/kvm/mmu.c in the Linux kernel through 4.13.5, when nested virtualisation is used, does not properly traverse guest pagetable entrieCVE-2017-121897.8It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handlinCVE-2017-12196.5IBM Tivoli Endpoint Manager is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could CVE-2017-121906.5The bio_map_user_iov and bio_unmap_user functions in block/bio.c in the Linux kernel before 4.13.8 do unbalanced refcounting when a SCSI I/OCVE-2017-121917.4A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access CVE-2017-121925.5The keyctl_read_key function in security/keys/keyctl.c in the Key Management subcomponent in the Linux kernel before 4.13.5 does not properlCVE-2017-121935.5The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel before 4.13.11 mishandles node splitting, which CVE-2017-121949.8A flaw was found in the way spice-client processed certain messages sent from the server. An attacker, having control of malicious spice-serCVE-2017-121954.8A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given nameCVE-2017-121965.9undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not enCVE-2017-121976.5It was found that libpam4j up to and including 1.8 did not properly validate user accounts when authenticating. A user with a valid passwordCVE-2017-121999.8The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogue
CVE-2017-12187: Critical severity, CVSS 9.8 | Vulnix