What’s Vulnerable › Vulnerabilities

CVE-2020-14344

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-05 · updated 2026-06-17
• Weakness: CWE-190

Description

An integer overflow leading to a heap-buffer overflow was found in The X Input Method (XIM) client was implemented in libX11 before version 1.6.10. As per upstream this is security relevant when setuid programs call XIM client functions while running with elevated privileges. No such programs are shipped with Red Hat Enterprise Linux.

Affected products

• Canonical Ubuntu Linux: 12.04, 14.04, 16.04, 18.04, 20.04
• Fedoraproject Fedora: 31, 32, 33
• openSUSE Leap: 15.1, 15.2
• x.org libX11: before 1.6.10 — fixed in 1.6.10

How to fix

Upgrade to a fixed version: x.org libX11 1.6.10. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00014.html
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00024.html
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00031.html
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14344
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4VDDSAYV7XGNRCXE7HCU23645MG74OFF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7AVXCQOSCAPKYYHFIJAZ6E2C7LJBTLXF/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XY4H2SIEF2362AMNX5ZKWAELGU7LKFJB/
• https://lists.x.org/archives/xorg-announce/2020-July/003050.html
• https://security.gentoo.org/glsa/202008-18
• https://usn.ubuntu.com/4487-1/
• https://usn.ubuntu.com/4487-2/

Get alerted when CVE-2020-14344 or the next vulnerability affects your stack