CVE-2020-14363

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An integer overflow vulnerability leading to a double-free was found in libX11. This flaw allows a local privileged attacker to cause an application compiled with libX11 to crash, or in some cases, result in arbitrary code execution. The highest threat from this flaw is to confidentiality, integrity as well as system availability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190 CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Sep 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-143645.0An out-of-bounds read/write access flaw was found in the USB emulator of the QEMU in versions before 5.2.0. This issue occurs while processi CVE-2020-143657.1A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packag CVE-2020-143667.5A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources CVE-2020-143676.0A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chr CVE-2020-143687.1A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, CVE-2020-143696.3This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted act CVE-2020-14377.8An elevation of privilege vulnerability exists in the way that the Windows Network Location Awareness Service handles objects in memory, aka CVE-2020-143705.3An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or th CVE-2020-143716.5A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are run CVE-2020-143727.5A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled.CVE-2020-143735.5A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25. A local attacker could supply a specially crafted PDF CVE-2020-143748.8A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_data function leads to a buffe