CVE-2018-14665

MEDIUM 6.6CVE-2018-14665 · Published 25/10/2018 · updated 17/06/2026

Package	Affected versions	Patched versions
x server x.org	`< 1.20.3`	`1.20.3`

Description

A flaw was found in xorg-x11-server before 1.20.3. An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.

References

packetstormsecurity.com/files/154942/Xorg-X11-Server-SUID-modulepath-Privilege-Escalation.html
packetstormsecurity.com/files/155276/Xorg-X11-Server-Local-Privilege-Escalation.html
securityfocus.com/bid/105741 · Third Party Advisory
securitytracker.com/id/1041948 · Third Party Advisory
access.redhat.com/errata/RHSA-2018:3410 · Third Party Advisory
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
gitlab.freedesktop.org/xorg/xserver/commit/50c0cf885a6e91c0ea71fb49fa8f1b7c86fe330e · Patch
gitlab.freedesktop.org/xorg/xserver/commit/8a59e3b7dbb30532a7c3769c555e00d7c4301170 · Patch
lists.x.org/archives/xorg-announce/2018-October/002927.html · Mitigation
security.gentoo.org/glsa/201810-09 · Third Party Advisory
usn.ubuntu.com/3802-1 · Third Party Advisory
debian.org/security/2018/dsa-4328 · Third Party Advisory
exploit-db.com/exploits/45697 · Exploit
exploit-db.com/exploits/45742 · Exploit
exploit-db.com/exploits/45832 · Exploit
exploit-db.com/exploits/45908 · Exploit
exploit-db.com/exploits/45922 · Exploit
exploit-db.com/exploits/45938 · Exploit
exploit-db.com/exploits/46142 · Exploit
securepatterns.com/2018/10/cve-2018-14665-xorg-x-server.html · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free