CVE-2008-1377 json
The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuth…
published 2008-06-16 18 y ago modified 2026-06-16 4 mo ago also EUVD-2008-1384
- cvss
- 9.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 86%
- public exploits
- 0
- none known
Summary
The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuthorization function in the Security extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via requests with crafted length values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.
Patch / fix
- xorg-server Debian 14, Debian 13, Debian 12 2:1.4.1~git20080517-2
debian advisories DEBIAN-CVE-2008-1377
- XFree86 RHEL 2.1 4.1.0-88.EL
- XFree86-twm RHEL 2.1 4.1.0-88.EL
- XFree86-xdm RHEL 2.1 4.1.0-88.EL
- XFree86-xfs RHEL 2.1 4.1.0-88.EL
- XFree86-libs RHEL 2.1 4.1.0-88.EL
- XFree86-Xvfb RHEL 2.1 4.1.0-88.EL
- XFree86-tools RHEL 2.1 4.1.0-88.EL
- XFree86-Xnest RHEL 2.1 4.1.0-88.EL
red hat advisories RHSA-2008:0512RHSA-2008:0504RHSA-2008:0503RHSA-2008:0502
- xorg-x11-server openSUSE Tumbleweed 1.20.13-1.2
opensuse advisories openSUSE-SU-2024:11525-1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2008-1377 updated
X.org Record and Security extensions memory corruption
-
Red Hat Desktop version 3 XFree86 4.3.0-128.EL, XFree86-sdk 4.3.0-128.EL, XFree86-twm 4.3.0-128.EL, XFree86-xdm 4.3.0-128.EL, XFree86-xfs 4.3.0-128.EL, XFree86-libs 4.3.0-128.EL, +22 morefixed: vendor fix RHSA-2008:0502
-
Red Hat Enterprise Linux (v. 5 server) xorg-x11-server 1.1.1-48.41.el5_2.1, xorg-x11-server-sdk 1.1.1-48.41.el5_2.1, xorg-x11-server-Xdmx 1.1.1-48.41.el5_2.1, xorg-x11-server-Xorg 1.1.1-48.41.el5_2.1, xorg-x11-server-Xvfb 1.1.1-48.41.el5_2.1, xorg-x11-server-Xnest 1.1.1-48.41.el5_2.1, +1 morefixed: vendor fix RHSA-2008:0504
-
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 XFree86 4.1.0-88.EL, XFree86-twm 4.1.0-88.EL, XFree86-xdm 4.1.0-88.EL, XFree86-xfs 4.1.0-88.EL, XFree86-libs 4.1.0-88.EL, XFree86-Xvfb 4.1.0-88.EL, +12 morefixed: vendor fix RHSA-2008:0512
-
Red Hat Enterprise Linux AS version 3 XFree86 4.3.0-128.EL, XFree86-sdk 4.3.0-128.EL, XFree86-twm 4.3.0-128.EL, XFree86-xdm 4.3.0-128.EL, XFree86-xfs 4.3.0-128.EL, XFree86-libs 4.3.0-128.EL, +22 morefixed: vendor fix RHSA-2008:0502
-
Red Hat Enterprise Linux AS version 4 xorg-x11 6.8.2-1.EL.33.0.4, xorg-x11-sdk 6.8.2-1.EL.33.0.4, xorg-x11-twm 6.8.2-1.EL.33.0.4, xorg-x11-xdm 6.8.2-1.EL.33.0.4, xorg-x11-xfs 6.8.2-1.EL.33.0.4, xorg-x11-libs 6.8.2-1.EL.33.0.4, +9 morefixed: vendor fix RHSA-2008:0503
-
Red Hat Enterprise Linux Desktop (v. 5 client) xorg-x11-server 1.1.1-48.41.el5_2.1, xorg-x11-server-sdk 1.1.1-48.41.el5_2.1, xorg-x11-server-Xdmx 1.1.1-48.41.el5_2.1, xorg-x11-server-Xorg 1.1.1-48.41.el5_2.1, xorg-x11-server-Xvfb 1.1.1-48.41.el5_2.1, xorg-x11-server-Xnest 1.1.1-48.41.el5_2.1, +1 morefixed: vendor fix RHSA-2008:0504
-
Red Hat Enterprise Linux Desktop version 4 xorg-x11 6.8.2-1.EL.33.0.4, xorg-x11-sdk 6.8.2-1.EL.33.0.4, xorg-x11-twm 6.8.2-1.EL.33.0.4, xorg-x11-xdm 6.8.2-1.EL.33.0.4, xorg-x11-xfs 6.8.2-1.EL.33.0.4, xorg-x11-libs 6.8.2-1.EL.33.0.4, +9 morefixed: vendor fix RHSA-2008:0503
-
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) xorg-x11-server 1.1.1-48.41.el5_2.1, xorg-x11-server-sdk 1.1.1-48.41.el5_2.1, xorg-x11-server-Xdmx 1.1.1-48.41.el5_2.1, xorg-x11-server-Xorg 1.1.1-48.41.el5_2.1, xorg-x11-server-Xvfb 1.1.1-48.41.el5_2.1, xorg-x11-server-Xnest 1.1.1-48.41.el5_2.1, +1 morefixed: vendor fix RHSA-2008:0504
show 7 moreshow fewer
-
Red Hat Enterprise Linux ES version 2.1 XFree86 4.1.0-88.EL, XFree86-twm 4.1.0-88.EL, XFree86-xdm 4.1.0-88.EL, XFree86-xfs 4.1.0-88.EL, XFree86-libs 4.1.0-88.EL, XFree86-Xvfb 4.1.0-88.EL, +12 morefixed: vendor fix RHSA-2008:0512
-
Red Hat Enterprise Linux ES version 3 XFree86 4.3.0-128.EL, XFree86-sdk 4.3.0-128.EL, XFree86-twm 4.3.0-128.EL, XFree86-xdm 4.3.0-128.EL, XFree86-xfs 4.3.0-128.EL, XFree86-libs 4.3.0-128.EL, +22 morefixed: vendor fix RHSA-2008:0502
-
Red Hat Enterprise Linux ES version 4 xorg-x11 6.8.2-1.EL.33.0.4, xorg-x11-sdk 6.8.2-1.EL.33.0.4, xorg-x11-twm 6.8.2-1.EL.33.0.4, xorg-x11-xdm 6.8.2-1.EL.33.0.4, xorg-x11-xfs 6.8.2-1.EL.33.0.4, xorg-x11-libs 6.8.2-1.EL.33.0.4, +9 morefixed: vendor fix RHSA-2008:0503
-
Red Hat Enterprise Linux WS version 2.1 XFree86 4.1.0-88.EL, XFree86-twm 4.1.0-88.EL, XFree86-xdm 4.1.0-88.EL, XFree86-xfs 4.1.0-88.EL, XFree86-libs 4.1.0-88.EL, XFree86-Xvfb 4.1.0-88.EL, +12 morefixed: vendor fix RHSA-2008:0512
-
Red Hat Enterprise Linux WS version 3 XFree86 4.3.0-128.EL, XFree86-sdk 4.3.0-128.EL, XFree86-twm 4.3.0-128.EL, XFree86-xdm 4.3.0-128.EL, XFree86-xfs 4.3.0-128.EL, XFree86-libs 4.3.0-128.EL, +22 morefixed: vendor fix RHSA-2008:0502
-
Red Hat Enterprise Linux WS version 4 xorg-x11 6.8.2-1.EL.33.0.4, xorg-x11-sdk 6.8.2-1.EL.33.0.4, xorg-x11-twm 6.8.2-1.EL.33.0.4, xorg-x11-xdm 6.8.2-1.EL.33.0.4, xorg-x11-xfs 6.8.2-1.EL.33.0.4, xorg-x11-libs 6.8.2-1.EL.33.0.4, +9 morefixed: vendor fix RHSA-2008:0503
-
Red Hat Linux Advanced Workstation 2.1 XFree86 4.1.0-88.EL, XFree86-twm 4.1.0-88.EL, XFree86-xdm 4.1.0-88.EL, XFree86-xfs 4.1.0-88.EL, XFree86-libs 4.1.0-88.EL, XFree86-Xvfb 4.1.0-88.EL, +12 morefixed: vendor fix RHSA-2008:0512
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.70% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-189 Numeric Errors
References
-
rhn.redhat.com
/errata/RHSA-2008-0502.html
vendor-advisory, patch
-
lists.opensuse.org
/opensuse-security-announce/2008-06/msg00002.html
vendor-advisory, patch
-
debian.org
/security/2008/dsa-1595
vendor-advisory, patch
-
ubuntu.com
/usn/usn-616-1
vendor-advisory, patch
-
sunsolve.sun.com
/search/document.do?assetkey=1-26-238686-1
vendor-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2008:115
vendor-advisory
-
h20000.www2.hp.com
/bizsupport/TechSupport/Document.jsp?objectID=c01543321
vendor-advisory
-
lists.apple.com
/archives/security-announce/2009/Feb/msg00000.html
vendor-advisory
-
security.gentoo.org
/glsa/glsa-200806-07.xml
vendor-advisory
-
mandriva.com
/security/advisories?name=MDVSA-2008:116
vendor-advisory
-
redhat.com
/support/errata/RHSA-2008-0503.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2008-0504.html
vendor-advisory
-
lists.opensuse.org
/opensuse-security-announce/2008-09/msg00005.html
vendor-advisory
-
rhn.redhat.com
/errata/RHSA-2008-0512.html
vendor-advisory
-
gentoo.org
/security/en/glsa/glsa-200807-07.xml
vendor-advisory
-
secunia.com
/advisories/30629
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/30664
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/30666
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/30627
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/30637
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/30628
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/30659
third-party-advisory, vendor-advisory
-
secunia.com
/advisories/30630
vendor-advisory
- issues.rpath.com /browse/RPL-2607
-
labs.idefense.com
/intelligence/vulnerabilities/display.php?id=721
third-party-advisory
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10109
vdb-entry, signature
-
secunia.com
/advisories/33937
third-party-advisory
-
securityfocus.com
/archive/1/493550/100/0/threaded
mailing-list
-
secunia.com
/advisories/31025
third-party-advisory
- support.apple.com /kb/HT3438
-
vupen.com
/english/advisories/2008/1833
vdb-entry
- wiki.rpath.com /wiki/Advisories:rPSA-2008-0201
-
secunia.com
/advisories/30715
third-party-advisory
-
vupen.com
/english/advisories/2008/1803
vdb-entry
- support.avaya.com /elmodocs2/security/ASA-2008-249.htm
-
secunia.com
/advisories/30772
third-party-advisory
-
securitytracker.com
/id?1020247
vdb-entry
-
secunia.com
/advisories/31109
third-party-advisory
-
vupen.com
/english/advisories/2008/1983/references
vdb-entry
-
secunia.com
/advisories/30671
third-party-advisory
-
secunia.com
/advisories/30809
third-party-advisory
- lists.freedesktop.org /archives/xorg/2008-June/036026.html
- secunia.com /advisories/30843
- secunia.com /advisories/32099
- secunia.com /advisories/32545
- securityfocus.com /archive/1/493548/100/0/threaded
Sources
- CVE List CVE-2008-1377
- NVD CVE-2008-1377
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.