CVE-2012-2118 - Vulnerability Details - OpenCVE

Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Complete

Integrity Impact Complete

Availability Impact Complete

This CVE is not in the KEV list.

The EPSS score is 0.02146.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

cpe:2.3:a:x.org:x11:1.11:*:*:*:*:*:*:*

No data.

No data.

Subscriptions

Vendors	Products
X.org Subscribe	X11 Subscribe

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2012-2120	Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.
Ubuntu USN	USN-1502-1	X.Org X Server vulnerability

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://patchwork.freedesktop.org/patch/10001/
http://www.openwall.com/lists/oss-security/2012/04/18/8
http://www.openwall.com/lists/oss-security/2012/04/19/2
http://www.securityfocus.com/bid/53150
https://exchange.xforce.ibmcloud.com/vulnerabilities/74930
https://nvd.nist.gov/vuln/detail/CVE-2012-2118
https://www.cve.org/CVERecord?id=CVE-2012-2118

History

No history.

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2012-05-18T22:00:00.000Z

Updated: 2024-08-06T19:26:08.431Z

Reserved: 2012-04-04T00:00:00.000Z

Link: CVE-2012-2118

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2012-05-18T22:55:03.093

Modified: 2025-04-11T00:51:21.963

Link: CVE-2012-2118

Redhat

Severity :

Publid Date: 2012-04-18T00:00:00Z

Links: CVE-2012-2118 - Bugzilla

OpenCVE Enrichment

No data.

Weaknesses

CWE-20

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-04-18T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01.000Z", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "53150", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/53150"}, {"name": "xorg-input-device-format-string(74930)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74930"}, {"tags": ["x_refsource_MISC"], "url": "http://patchwork.freedesktop.org/patch/10001/"}, {"name": "[oss-security] 20120418 Re: CVE request: Xorg input device format string flaw", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/04/19/2"}, {"name": "[oss-security] 20120418 CVE request: Xorg input device format string flaw", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2012/04/18/8"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T19:26:08.431Z"}, "title": "CVE Program Container", "references": [{"name": "53150", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/53150"}, {"name": "xorg-input-device-format-string(74930)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74930"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://patchwork.freedesktop.org/patch/10001/"}, {"name": "[oss-security] 20120418 Re: CVE request: Xorg input device format string flaw", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2012/04/19/2"}, {"name": "[oss-security] 20120418 CVE request: Xorg input device format string flaw", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2012/04/18/8"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-2118", "datePublished": "2012-05-18T22:00:00.000Z", "dateReserved": "2012-04-04T00:00:00.000Z", "dateUpdated": "2024-08-06T19:26:08.431Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:x.org:x11:1.11:*:*:*:*:*:*:*", "matchCriteriaId": "3F2CAB6B-770B-467A-9C24-2A26E189A6D0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name."}, {"lang": "es", "value": "Vulnerabilidad de formato de cadena en la funci\u00f3n LogVHdrMessageVerb en OS/log.c en X11 X.Org v1.11 permite a atacantes provocar una denegaci\u00f3n de servicio o posiblemente ejecutar c\u00f3digo arbitrario mediante especificadores de formato de cadena en el nombre de un dispositivo de entrada."}], "id": "CVE-2012-2118", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-05-18T22:55:03.093", "references": [{"source": "secalert@redhat.com", "tags": ["Patch"], "url": "http://patchwork.freedesktop.org/patch/10001/"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/04/18/8"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2012/04/19/2"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/53150"}, {"source": "secalert@redhat.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74930"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "http://patchwork.freedesktop.org/patch/10001/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2012/04/18/8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2012/04/19/2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/53150"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/74930"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}