CVE-2017-12187 - Vulnerability Details - OpenCVE

xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.00773.

Key SSVC decision points have not yet been added.

Vendors	Products
Debian	Debian Linux
X.org	X Server

Configuration 1 [-]

OR	cpe:2.3:o:debian:debian_linux:8.0:::::::*
	cpe:2.3:o:debian:debian_linux:9.0:::::::*

Configuration 2 [-]

cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*

No data.

No data.

References

Link	Providers
https://bugzilla.redhat.com/show_bug.cgi?id=1509217
https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e
https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html
https://nvd.nist.gov/vuln/detail/CVE-2017-12187
https://www.cve.org/CVERecord?id=CVE-2017-12187
https://www.debian.org/security/2017/dsa-4000

History

Fri, 29 Aug 2025 13:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		X.org x Server
CPEs	cpe:2.3:a:x.org:xorg-server::::::::	cpe:2.3:a:x.org:x_server::::::::
Vendors & Products	X.org xorg-server	X.org x Server

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00888}`	epss `{'score': 0.00815}`

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2018-01-24T15:00:00Z

Updated: 2024-09-16T19:30:41.654Z

Reserved: 2017-08-01T00:00:00

Link: CVE-2017-12187

Vulnrichment

No data.

NVD

Status : Modified

Published: 2018-01-24T15:29:00.997

Modified: 2025-08-29T13:42:30.557

Link: CVE-2017-12187

Redhat

Severity : Moderate

Publid Date: 2017-10-10T00:00:00Z

Links: CVE-2017-12187 - Bugzilla

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "xorg-x11-server", "vendor": "The X.Org Foundation", "versions": [{"status": "affected", "version": "before 1.19.5"}]}], "datePublic": "2017-10-10T00:00:00", "descriptions": [{"lang": "en", "value": "xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-391", "description": "CWE-391", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2018-02-02T10:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "DSA-4000", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "https://www.debian.org/security/2017/dsa-4000"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1509217"}, {"name": "[debian-lts-announce] 20171122 [SECURITY] [DLA 1186-1] xorg-server security update", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert@redhat.com", "DATE_PUBLIC": "2017-10-10T00:00:00", "ID": "CVE-2017-12187", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "xorg-x11-server", "version": {"version_data": [{"version_value": "before 1.19.5"}]}}]}, "vendor_name": "The X.Org Foundation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-391"}]}]}, "references": {"reference_data": [{"name": "DSA-4000", "refsource": "DEBIAN", "url": "https://www.debian.org/security/2017/dsa-4000"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1509217", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1509217"}, {"name": "[debian-lts-announce] 20171122 [SECURITY] [DLA 1186-1] xorg-server security update", "refsource": "MLIST", "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html"}, {"name": "https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e", "refsource": "CONFIRM", "url": "https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T18:28:16.644Z"}, "title": "CVE Program Container", "references": [{"name": "DSA-4000", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "https://www.debian.org/security/2017/dsa-4000"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1509217"}, {"name": "[debian-lts-announce] 20171122 [SECURITY] [DLA 1186-1] xorg-server security update", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2017-12187", "datePublished": "2018-01-24T15:00:00Z", "dateReserved": "2017-08-01T00:00:00", "dateUpdated": "2024-09-16T19:30:41.654Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7738370-58C4-4212-9AF1-5E61186C837F", "versionEndExcluding": "1.19.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code."}, {"lang": "es", "value": "xorg-x11-server en versiones anteriores a la 1.19.5 no ten\u00eda una validaci\u00f3n de longitud en la extensi\u00f3n RENDER, lo que permit\u00eda que atacantes remotos permitan que el cliente malicioso X provoque que el servidor X se cierre inesperadamente o que, posiblemente, ejecute c\u00f3digo arbitrario."}], "id": "CVE-2017-12187", "lastModified": "2025-08-29T13:42:30.557", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-24T15:29:00.997", "references": [{"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1509217"}, {"source": "secalert@redhat.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e"}, {"source": "secalert@redhat.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2017/dsa-4000"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1509217"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00032.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2017/dsa-4000"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-391"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}