Read the docs
TI-2011-00392 Aliases CVE-2011-0465GHSA-wphx-j4h9-hfr8

xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to…

Priority MEDIUM 49CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
—
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a (1) DHCP or (2) XDMCP message.

Why it matters now

EPSS 0.05781 93rd percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 31

CPEVersionsRoleVendor
cpe:2.3:a:matthias_hopf:xrdb:*:*:*:*:*:*:*:*up to 1.0.8VulnerableMatthias Hopf
cpe:2.3:a:matthias_hopf:xrdb:1.0.2:*:*:*:*:*:*:*1.0.2VulnerableMatthias Hopf
cpe:2.3:a:matthias_hopf:xrdb:1.0.3:*:*:*:*:*:*:*1.0.3VulnerableMatthias Hopf
cpe:2.3:a:matthias_hopf:xrdb:1.0.4:*:*:*:*:*:*:*1.0.4VulnerableMatthias Hopf
cpe:2.3:a:matthias_hopf:xrdb:1.0.5:*:*:*:*:*:*:*1.0.5VulnerableMatthias Hopf
cpe:2.3:a:matthias_hopf:xrdb:1.0.6:*:*:*:*:*:*:*1.0.6VulnerableMatthias Hopf
cpe:2.3:a:matthias_hopf:xrdb:1.0.7:*:*:*:*:*:*:*1.0.7VulnerableMatthias Hopf
cpe:2.3:a:x:x11:*:*:*:*:*:*:*:*up to r7.6VulnerableX
cpe:2.3:a:x:x11:r1:*:*:*:*:*:*:*r1VulnerableX
cpe:2.3:a:x:x11:r2:*:*:*:*:*:*:*r2VulnerableX
  • cpe:2.3:a:matthias_hopf:xrdb:*:*:*:*:*:*:*:* Versions up to 1.0.8 Vulnerable ·Matthias Hopf
  • cpe:2.3:a:matthias_hopf:xrdb:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Matthias Hopf
  • cpe:2.3:a:matthias_hopf:xrdb:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Matthias Hopf
  • cpe:2.3:a:matthias_hopf:xrdb:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Matthias Hopf
  • cpe:2.3:a:matthias_hopf:xrdb:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·Matthias Hopf
  • cpe:2.3:a:matthias_hopf:xrdb:1.0.6:*:*:*:*:*:*:* Versions 1.0.6 Vulnerable ·Matthias Hopf
  • cpe:2.3:a:matthias_hopf:xrdb:1.0.7:*:*:*:*:*:*:* Versions 1.0.7 Vulnerable ·Matthias Hopf
  • cpe:2.3:a:x:x11:*:*:*:*:*:*:*:* Versions up to r7.6 Vulnerable ·X
  • cpe:2.3:a:x:x11:r1:*:*:*:*:*:*:* Versions r1 Vulnerable ·X
  • cpe:2.3:a:x:x11:r2:*:*:*:*:*:*:* Versions r2 Vulnerable ·X
Show 21 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:x:x11:r3:*:*:*:*:*:*:*r3VulnerableX
cpe:2.3:a:x:x11:r4:*:*:*:*:*:*:*r4VulnerableX
cpe:2.3:a:x:x11:r5:*:*:*:*:*:*:*r5VulnerableX
cpe:2.3:a:x:x11:r6:*:*:*:*:*:*:*r6VulnerableX
cpe:2.3:a:x:x11:r6.1:*:*:*:*:*:*:*r6.1VulnerableX
cpe:2.3:a:x:x11:r6.3:*:*:*:*:*:*:*r6.3VulnerableX
cpe:2.3:a:x:x11:r6.4:*:*:*:*:*:*:*r6.4VulnerableX
cpe:2.3:a:x:x11:r6.5.1:*:*:*:*:*:*:*r6.5.1VulnerableX
cpe:2.3:a:x:x11:r6.6:*:*:*:*:*:*:*r6.6VulnerableX
cpe:2.3:a:x:x11:r6.7:*:*:*:*:*:*:*r6.7VulnerableX
cpe:2.3:a:x:x11:r6.7.0:*:*:*:*:*:*:*r6.7.0VulnerableX
cpe:2.3:a:x:x11:r6.8.0:*:*:*:*:*:*:*r6.8.0VulnerableX
cpe:2.3:a:x:x11:r6.8.1:*:*:*:*:*:*:*r6.8.1VulnerableX
cpe:2.3:a:x:x11:r6.8.2:*:*:*:*:*:*:*r6.8.2VulnerableX
cpe:2.3:a:x:x11:r6.9.0:*:*:*:*:*:*:*r6.9.0VulnerableX
cpe:2.3:a:x:x11:r7.0:*:*:*:*:*:*:*r7.0VulnerableX
cpe:2.3:a:x:x11:r7.1:*:*:*:*:*:*:*r7.1VulnerableX
cpe:2.3:a:x:x11:r7.2:*:*:*:*:*:*:*r7.2VulnerableX
cpe:2.3:a:x:x11:r7.3:*:*:*:*:*:*:*r7.3VulnerableX
cpe:2.3:a:x:x11:r7.4:*:*:*:*:*:*:*r7.4VulnerableX
cpe:2.3:a:x:x11:r7.5:*:*:*:*:*:*:*r7.5VulnerableX
  • cpe:2.3:a:x:x11:r3:*:*:*:*:*:*:* Versions r3 Vulnerable ·X
  • cpe:2.3:a:x:x11:r4:*:*:*:*:*:*:* Versions r4 Vulnerable ·X
  • cpe:2.3:a:x:x11:r5:*:*:*:*:*:*:* Versions r5 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6:*:*:*:*:*:*:* Versions r6 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6.1:*:*:*:*:*:*:* Versions r6.1 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6.3:*:*:*:*:*:*:* Versions r6.3 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6.4:*:*:*:*:*:*:* Versions r6.4 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6.5.1:*:*:*:*:*:*:* Versions r6.5.1 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6.6:*:*:*:*:*:*:* Versions r6.6 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6.7:*:*:*:*:*:*:* Versions r6.7 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6.7.0:*:*:*:*:*:*:* Versions r6.7.0 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6.8.0:*:*:*:*:*:*:* Versions r6.8.0 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6.8.1:*:*:*:*:*:*:* Versions r6.8.1 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6.8.2:*:*:*:*:*:*:* Versions r6.8.2 Vulnerable ·X
  • cpe:2.3:a:x:x11:r6.9.0:*:*:*:*:*:*:* Versions r6.9.0 Vulnerable ·X
  • cpe:2.3:a:x:x11:r7.0:*:*:*:*:*:*:* Versions r7.0 Vulnerable ·X
  • cpe:2.3:a:x:x11:r7.1:*:*:*:*:*:*:* Versions r7.1 Vulnerable ·X
  • cpe:2.3:a:x:x11:r7.2:*:*:*:*:*:*:* Versions r7.2 Vulnerable ·X
  • cpe:2.3:a:x:x11:r7.3:*:*:*:*:*:*:* Versions r7.3 Vulnerable ·X
  • cpe:2.3:a:x:x11:r7.4:*:*:*:*:*:*:* Versions r7.4 Vulnerable ·X
  • cpe:2.3:a:x:x11:r7.5:*:*:*:*:*:*:* Versions r7.5 Vulnerable ·X

Remediation

Red Hat 2 advisories

  • RHSA-2011:0432 Released 2011-04-11 · Red Hat rating Moderate
    xorg-x11 security update
    • Red Hat Enterprise Linux AS version 4 xorg-x11-6.8.2-1.EL.67, xorg-x11-6.8.2-1.EL.67.i386, xorg-x11-6.8.2-1.EL.67.ia64 +47
    • Red Hat Enterprise Linux Desktop version 4 xorg-x11-6.8.2-1.EL.67, xorg-x11-6.8.2-1.EL.67.i386, xorg-x11-Mesa-libGL-6.8.2-1.EL.67 +33
    • Red Hat Enterprise Linux ES version 4 xorg-x11-6.8.2-1.EL.67, xorg-x11-6.8.2-1.EL.67.i386, xorg-x11-6.8.2-1.EL.67.ia64 +47
    • Red Hat Enterprise Linux WS version 4 xorg-x11-6.8.2-1.EL.67, xorg-x11-6.8.2-1.EL.67.i386, xorg-x11-6.8.2-1.EL.67.ia64 +47
  • RHSA-2011:0433 Released 2011-04-11 · Red Hat rating Moderate
    xorg-x11-server-utils security update
    • Red Hat Enterprise Linux (v. 5.6.z server) xorg-x11-server-utils-7.1-5.el5_6.1, xorg-x11-server-utils-7.1-5.el5_6.1.i386, xorg-x11-server-utils-7.1-5.el5_6.1.ia64 +1
    • Red Hat Enterprise Linux Desktop (v. 6) xorg-x11-server-utils-7.4-15.el6_0.1
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) xorg-x11-server-utils-7.4-15.el6_0.1
    • Red Hat Enterprise Linux Server (v. 6) xorg-x11-server-utils-7.4-15.el6_0.1
    • Red Hat Enterprise Linux Workstation (v. 6) xorg-x11-server-utils-7.4-15.el6_0.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5.6.z server)Fixed RHSA-2011:0433
Red Hat Enterprise Linux AS version 4Fixed RHSA-2011:0432
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2011:0433
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2011:0432
Red Hat Enterprise Linux ES version 4Fixed RHSA-2011:0432
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2011:0433
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:0433
Red Hat Enterprise Linux WS version 4Fixed RHSA-2011:0432
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2011:0433

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-0465
  2. 2026-10-03 Alias added: GHSA-wphx-j4h9-hfr8

References

Patch 4

Advisory 10

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences