Read the docs
TI-2020-11215 Aliases CVE-2020-14344GHSA-g6cq-58wq-v493

Integer overflow in X11 Project libX11

Priority LOW 30CWE-190Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.

Why it matters now

EPSS 0.00455 39th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 2 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
The X11 ProjectlibX111.6.10—No fix listedCNA
  • libX11 VendorThe X11 Project Affected 1.6.10 Fixed in — No fix listed CNA

CPE configurations NVD · 11

CPEVersionsRoleVendor
cpe:2.3:a:x.org:libx11:*:*:*:*:*:*:*:*before 1.6.10Vulnerablex.org
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*33VulnerableFedoraproject
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*12.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*14.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04VulnerableCanonical
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
  • cpe:2.3:a:x.org:libx11:*:*:*:*:*:*:*:* Versions before 1.6.10 Vulnerable ·x.org
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:* Versions 12.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* Versions 14.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Vulnerable ·Canonical
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
Show 1 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*15.2VulnerableopenSUSE
  • cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE

Remediation

Red Hat 1 advisory

  • RHSA-2021:1804 Released 2021-05-18 · Red Hat rating Moderate
    userspace graphics, xorg-x11, and mesa security, bug fix, and enhancement update
    • Red Hat CodeReady Linux Builder (v. 8) libinput-devel-1.16.3-1.el8, libwacom-devel-1.6-2.el8, mesa-libOSMesa-devel-20.3.3-2.el8 +3
    • Red Hat Enterprise Linux AppStream (v. 8) egl-wayland-1.1.5-3.el8, libX11-1.6.8-4.el8, libX11-common-1.6.8-4.el8 +38

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2021:1804
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2021:1804

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-14344
  2. 2026-10-03 Alias added: GHSA-g6cq-58wq-v493

References

Patch 3

Advisory 10

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences