CVE-2011-4028

Published: Jul 3, 2012Modified: Apr 29, 2026

1.2

Vector

AV:L/AC:H/Au:N/C:P/I:N/A:N

Exploitability: 1.9 / Impact: 2.9

Source: NVD

Description

The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.

Affected (2)

Products: X.org: X Server

X.org

1 product

X Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
X.org X Server	Up to 1.11.1
X.org X Server	Version 1.11.0

Related CWEs

CWE-59

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (10)

http://cgit.freedesktop.org/xorg/xserver/commit/?id=6ba44b91e37622ef8c146d8f2ac92d708a18ed34

Source: cve@mitre.org

http://lists.freedesktop.org/archives/xorg/2011-October/053680.html

Source: cve@mitre.org

http://rhn.redhat.com/errata/RHSA-2012-0939.html

Source: cve@mitre.org

http://secunia.com/advisories/46460

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/49579

Source: cve@mitre.org

Vendor Advisory

http://cgit.freedesktop.org/xorg/xserver/commit/?id=6ba44b91e37622ef8c146d8f2ac92d708a18ed34