Vulnerability in X.org X Server
CVE-2011-4029
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.
Vulnerability class: Race Condition
EPSS: 0.006 (45.4th percentile) — read the EPSS interpretation.
Affected products
- X.org X_server — versions 1.11.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (mailing-list, x_refsource_MLIST)
- cve@mitre.org (x_refsource_CONFIRM, Patch)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (x_refsource_REDHAT, vendor-advisory)
- cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2011-4029?
- CVE-2011-4029 is a vulnerability in X.org X Server, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). Published 2012-07-03.
- Is CVE-2011-4029 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.