What is CVE-2020-14346?

CVE-2020-14346 is a security vulnerability affecting the X.Org X Server, a widely used software component in various systems. This vulnerability is caused by an integer underflow in the X input extension protocol decoding, which may lead to arbitrary access of memory contents. The issue impacts systems running xorg-x11-server before version 1.20.9 and has the potential to be exploited for privilege escalation. It is essential for users to update their systems to a secure version to mitigate the risk associated with this vulnerability.

Who is impacted by CVE-2020-14346?

It impacts certain versions of Ubuntu Linux and Red Hat Enterprise Linux, including Ubuntu Linux 14.04 and Red Hat Enterprise Linux 6.0, 7.0, and 8.0. This security issue is caused by an integer underflow in the X input extension protocol decoding in the X server, which may lead to arbitrary access of memory contents. Users should be aware of this vulnerability and its potential impact on data confidentiality, integrity, and system availability.

What should I do if I’m affected?

If you're affected by the CVE-2020-14346 vulnerability, it's crucial to update your system to a secure version. Here are the steps to follow:

1. Check if your system is running xorg-x11-server before version 1.20.9, or affected versions of Ubuntu Linux and Red Hat Enterprise Linux.

2. For Ubuntu 14.04 ESM users, follow the Ubuntu security notice to update the xorg-server package.

3. For Gentoo users, follow the Gentoo security advisory to update the x11-base/xorg-server package.

4. For Red Hat Enterprise Linux users, refer to the Red Hat Bugzilla entry and corresponding errata pages for updates.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2020-14346 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This security issue affects the X.Org X Server and can lead to arbitrary access of memory contents.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-191, which involves an integer underflow issue in the X input extension protocol decoding in the X server.

Learn More

CVE-2020-14346 is a security vulnerability affecting the X.Org X Server, with potential impacts on data confidentiality, integrity, and system availability. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the sources listed below.

• Red Hat Bugzilla entry

• X.Org server security advisory

• Gentoo security advisory

• Ubuntu security notice