CVE-2020-14344 is a medium-severity vulnerability affecting the X Input Method (XIM) client implemented in libX11 before version 1.6.10. This vulnerability is caused by an integer overflow leading to a heap-buffer overflow, which can be security relevant when setuid programs call XIM client functions while running with elevated privileges. Systems affected by this vulnerability include those running libX11 before version 1.6.10, Fedora, Ubuntu Linux, and openSUSE Leap.

How do I know if I'm affected?

If you're using libX11 before version 1.6.10, Fedora, Ubuntu Linux, or openSUSE Leap, you might be affected by the vulnerability. This issue is related to an integer overflow leading to a heap-buffer overflow in the X Input Method (XIM) client. To check if you're affected, verify the version of libX11 and the operating system you're using. Keep in mind that this vulnerability is more relevant when setuid programs call XIM client functions with elevated privileges.

What should I do if I'm affected?

If you're affected by the vulnerability, it's important to update your system immediately. For openSUSE Leap users, follow these steps. Use YaST online_update or zypper patch to install the security update. Alternatively, run the command zypper in -t patch openSUSE-2020-1162=1 for openSUSE Leap 15.1 or the appropriate command for your version.

Is CVE-2020-14344 in CISA’s Known Exploited Vulnerabilities Catalog?

CVE-2020-14344 is not listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, related to an integer overflow leading to a heap-buffer overflow in the X Input Method (XIM) client, was published on August 5, 2020. There is no specific due date or required action mentioned, but updating your system and following the provided advisories, solutions, and tools can help address the issue.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-190, which describes CVE-2020-14344 as an integer overflow or wraparound issue affecting libX11. This vulnerability leads to XIM client heap overflows in openSUSE Leap systems.

For more details

CVE-2020-14344 is a medium-severity vulnerability that affects various systems and software configurations. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the links below.

• openSUSE Security Announcement - libX11 Update for openSUSE Leap 15.1

• openSUSE Security Announcement - libX11 Update for openSUSE Leap 15.2

• openSUSE Security Announcement - libX11 Update for openSUSE Leap 15.2 (2)

• openSUSE Security Announcement - libX11 Update for openSUSE Leap 15.1 (2)