CVE-2020-2656

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data as well as unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Affected software

Vendor	Product	Versions
Oracle Corporation	Solaris Operating System	10; 11

References

http://packetstormsecurity.com/files/155990/Solaris-xlock-Information-Disclosure.htmlExploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://seclists.org/fulldisclosure/2020/Jan/23Exploit, Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/01/20/2Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/23Exploit, Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Vendor Advisory
http://packetstormsecurity.com/files/155990/Solaris-xlock-Information-Disclosure.htmlExploit, Patch, Third Party Advisory, VDB Entry, Vendor Advisory
http://seclists.org/fulldisclosure/2020/Jan/23Exploit, Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/01/20/2Mailing List, Third Party Advisory
https://seclists.org/bugtraq/2020/Jan/23Exploit, Mailing List, Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2020.htmlPatch, Vendor Advisory

Timeline

Published: Jan 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-265608.1Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence f CVE-2020-265618.8Belkin LINKSYS WRT160NL 1.0.04.002_US_20130619 devices have a stack-based buffer overflow vulnerability because of sprintf in create_dir in CVE-2020-265636.1ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also CVE-2020-265646.5ObjectPlanet Opinio before 7.15 allows XXE attacks via three steps: modify a .css file to have <!ENTITY content, create a .xml file for a ge CVE-2020-265657.5ObjectPlanet Opinio before 7.14 allows Expression Language Injection via the admin/permissionList.do from parameter. This can be used to ret CVE-2020-265667.5A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation CVE-2020-265675.5An issue was discovered on D-Link DSR-250N before 3.17B devices. The CGI script upgradeStatusReboot.cgi can be accessed without authenticati CVE-2020-265695.9In EVPN VxLAN setups in Arista EOS, specific malformed packets can lead to incorrect MAC to IP bindings and as a result packets can be incor CVE-2020-26574.7Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that ar CVE-2020-265705.5The Oberthur smart card software driver in OpenSC before 0.21.0-rc1 has a heap-based buffer overflow in sc_oberthur_read_file.CVE-2020-265715.5The gemsafe GPK smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in sc_pkcs15emu_gemsafeGPK_init.CVE-2020-265725.5The TCOS smart card software driver in OpenSC before 0.21.0-rc1 has a stack-based buffer overflow in tcos_decipher.