CVE-2014-8093

Name	CVE-2014-8093
Description	Multiple integer overflows in the GLX extension in XFree86 4.0, X.Org X Window System (aka X11 or X) X11R6.7, and X.Org Server (aka xserver and xorg-server) before 1.16.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via a crafted request to the (1) __glXDisp_ReadPixels, (2) __glXDispSwap_ReadPixels, (3) __glXDisp_GetTexImage, (4) __glXDispSwap_GetTexImage, (5) GetSeparableFilter, (6) GetConvolutionFilter, (7) GetHistogram, (8) GetMinmax, (9) GetColorTable, (10) __glXGetAnswerBuffer, (11) __GLX_GET_ANSWER_BUFFER, (12) __glXMap1dReqSize, (13) __glXMap1fReqSize, (14) Map2Size, (15) __glXMap2dReqSize, (16) __glXMap2fReqSize, (17) __glXImageSize, or (18) __glXSeparableFilter2DReqSize function, which triggers an out-of-bounds read or write.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-120-1, DSA-3095-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xorg-server (PTS)	jessie, jessie (lts)	2:1.16.4-1+deb8u17	fixed
	stretch (security)	2:1.19.2-1+deb9u9	fixed
	stretch (lts), stretch	2:1.19.2-1+deb9u20	fixed
	buster, buster (lts)	2:1.20.4-1+deb10u15	fixed
	buster (security)	2:1.20.4-1+deb10u14	fixed
	bullseye	2:1.20.11-1+deb11u13	fixed
	bullseye (security)	2:1.20.11-1+deb11u14	fixed
	bookworm (security), bookworm	2:21.1.7-3+deb12u8	fixed
	trixie	2:21.1.14-2	fixed
	sid	2:21.1.15-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
xorg-server	source	squeeze	2:1.7.7-18+deb6u1		DLA-120-1
xorg-server	source	wheezy	2:1.12.4-6+deb7u5		DSA-3095-1
xorg-server	source	(unstable)	2:1.16.2.901-1