Read the docs
TI-2013-01835 Aliases CVE-2013-2064GHSA-7f35-cmpc-qjfq

Integer overflow in X.org libxcb 1.9 and earlier allows X servers to trigger allocation…

Priority LOW 35CWE-189Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-189 and the CVSS impact.

Summary

Integer overflow in X.org libxcb 1.9 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the read_packet function.

Why it matters now

EPSS 0.02451 84th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 24

CPEVersionsRoleVendor
cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*6.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*7.0VulnerableDebian
cpe:2.3:a:oracle:secure_global_desktop:4.71:*:*:*:*:*:*:*4.71VulnerableOracle
cpe:2.3:a:oracle:secure_global_desktop:5.2:*:*:*:*:*:*:*5.2VulnerableOracle
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*10.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*12.10VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*13.04VulnerableCanonical
cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*12.2VulnerableopenSUSE
cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*12.3VulnerableopenSUSE
  • cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:secure_global_desktop:4.71:*:*:*:*:*:*:* Versions 4.71 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:secure_global_desktop:5.2:*:*:*:*:*:*:* Versions 5.2 Vulnerable ·Oracle
  • cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:* Versions 10.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* Versions 12.10 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:* Versions 13.04 Vulnerable ·Canonical
  • cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:* Versions 12.3 Vulnerable ·openSUSE
Show 14 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:*19VulnerableFedoraproject
cpe:2.3:a:x:libxcb:*:*:*:*:*:*:*:*up to 1.9VulnerableX
cpe:2.3:a:x:libxcb:1.1.90.1:*:*:*:*:*:*:*1.1.90.1VulnerableX
cpe:2.3:a:x:libxcb:1.1.91:*:*:*:*:*:*:*1.1.91VulnerableX
cpe:2.3:a:x:libxcb:1.1.92:*:*:*:*:*:*:*1.1.92VulnerableX
cpe:2.3:a:x:libxcb:1.1.93:*:*:*:*:*:*:*1.1.93VulnerableX
cpe:2.3:a:x:libxcb:1.2:*:*:*:*:*:*:*1.2VulnerableX
cpe:2.3:a:x:libxcb:1.3:*:*:*:*:*:*:*1.3VulnerableX
cpe:2.3:a:x:libxcb:1.4:*:*:*:*:*:*:*1.4VulnerableX
cpe:2.3:a:x:libxcb:1.5:*:*:*:*:*:*:*1.5VulnerableX
cpe:2.3:a:x:libxcb:1.6:*:*:*:*:*:*:*1.6VulnerableX
cpe:2.3:a:x:libxcb:1.7:*:*:*:*:*:*:*1.7VulnerableX
cpe:2.3:a:x:libxcb:1.8:*:*:*:*:*:*:*1.8VulnerableX
cpe:2.3:a:x:libxcb:1.8.1:*:*:*:*:*:*:*1.8.1VulnerableX
  • cpe:2.3:o:fedoraproject:fedora:19:*:*:*:*:*:*:* Versions 19 Vulnerable ·Fedoraproject
  • cpe:2.3:a:x:libxcb:*:*:*:*:*:*:*:* Versions up to 1.9 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.1.90.1:*:*:*:*:*:*:* Versions 1.1.90.1 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.1.91:*:*:*:*:*:*:* Versions 1.1.91 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.1.92:*:*:*:*:*:*:* Versions 1.1.92 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.1.93:*:*:*:*:*:*:* Versions 1.1.93 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·X
  • cpe:2.3:a:x:libxcb:1.8.1:*:*:*:*:*:*:* Versions 1.8.1 Vulnerable ·X

Remediation

Red Hat 1 advisory

  • RHSA-2014:1436 Released 2014-10-13 · Red Hat rating Moderate
    X11 client libraries security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Desktop (v. 6) libX11-1.6.0-2.2.el6, libX11-common-1.6.0-2.2.el6, libXcursor-1.1.14-2.1.el6 +17
    • Red Hat Enterprise Linux Desktop Optional (v. 6) libX11-devel-1.6.0-2.2.el6, libXcursor-devel-1.1.14-2.1.el6, libXext-devel-1.3.2-2.1.el6 +23
    • Red Hat Enterprise Linux HPC Node (v. 6) libX11-1.6.0-2.2.el6, libX11-common-1.6.0-2.2.el6, libXcursor-1.1.14-2.1.el6 +12
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) libX11-devel-1.6.0-2.2.el6, libXcursor-devel-1.1.14-2.1.el6, libXext-devel-1.3.2-2.1.el6 +24
    • Red Hat Enterprise Linux Server (v. 6) libX11-1.6.0-2.2.el6, libX11-1.6.0-2.2.el6.ppc, libX11-common-1.6.0-2.2.el6 +47
    • Red Hat Enterprise Linux Server Optional (v. 6) libXres-devel-1.0.7-2.1.el6, libXres-devel-1.0.7-2.1.el6.ppc, libXvMC-devel-1.0.8-2.1.el6 +13
    • Red Hat Enterprise Linux Workstation (v. 6) libX11-1.6.0-2.2.el6, libX11-common-1.6.0-2.2.el6, libX11-devel-1.6.0-2.2.el6 +32
    • Red Hat Enterprise Linux Workstation Optional (v. 6) libXres-devel-1.0.7-2.1.el6, libXvMC-devel-1.0.8-2.1.el6, libXxf86dga-1.1.4-2.1.el6 +8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2014:1436
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2014:1436
Red Hat Enterprise Linux HPC Node (v. 6)Fixed RHSA-2014:1436
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2014:1436
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:1436
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2014:1436
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:1436
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2014:1436

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-2064
  2. 2026-10-03 Alias added: GHSA-7f35-cmpc-qjfq

References

Advisory 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences