Skip to content
Fencer Vulns
critical 9.8

CVE-2021-31535 in the critical feed json

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code.

published 2021-05-27 5 y ago modified 2026-07-18 3 mo ago also EUVD-2021-18433 , JLSEC-2026-471

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
10.4%
EPSS 10.4% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

LookupCol.c in X.Org X through X11R7.7 and libX11 before 1.7.1 might allow remote attackers to execute arbitrary code. The libX11 XLookupColor request (intended for server-side color lookup) contains a flaw allowing a client to send color-name requests with a name longer than the maximum size allowed by the protocol (and also longer than the maximum packet size for normal-sized packets). The user-controlled data exceeding the maximum size is then interpreted by the server as additional X protocol requests and executed, e.g., to disable X server authorization completely. For example, if the victim encounters malicious terminal control sequences for color codes, then the attacker may be able to take full control of the running graphical session.

Patch / fix

  • julia Xorg_libX11_jll 1.8.6+0
  • x.org libx11 1.7.1
  • libx11 Debian 14, Debian 13, Debian 12 2:1.7.1-1

debian advisories DEBIAN-CVE-2021-31535

  • libx11 Ubuntu 18.04 LTS 2:1.6.4-3ubuntu0.4
  • libx11 Ubuntu 20.04 LTS 2:1.6.9-2ubuntu1.2
  • libx11 Ubuntu Pro 14.04 LTS 2:1.6.2-1ubuntu2.1+esm2
  • libx11 Ubuntu Pro 16.04 LTS 2:1.6.3-1ubuntu2.2+esm1

ubuntu advisories UBUNTU-CVE-2021-31535

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libX11 RHEL 8 1.6.8-5.el8
  • libX11-xcb RHEL 8 1.6.8-5.el8
  • libX11-common RHEL 8 1.6.8-5.el8
  • redhat-virtualization-host RHEL 7 4.3.18-20210903.0.el7_9
  • redhat-virtualization-host-image-update RHEL 7 4.3.18-20210903.0.el7_9
  • libX11 RHEL 7 1.6.7-4.el7_9
  • libX11-common RHEL 7 1.6.7-4.el7_9

red hat advisories RHSA-2021:4326RHSA-2021:3477RHSA-2021:3296

  • xorg-x11-libX11 SLES 11 SP4-LTSS, SLE Point of Sale 11 SP3 7.4-5.11.72.27.1
  • libX11 SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +13 more 1.6.5-3.21.1
  • libX11 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +11 more 1.6.2-12.21.1
  • libX11 SLES for SAP 12 SP5, SLES 12 SP5, SLE Software Development Kit 12 SP5 1.6.2-12.18.1
  • libX11 SLE Module for Basesystem 15 SP3, SLE Module for Basesystem 15 SP2, SLE Micro 5.0 1.6.5-3.18.1

suse advisories SUSE-SU-2021:14748-1SUSE-SU-2021:1897-1SUSE-SU-2021:1892-1SUSE-SU-2021:1766-1SUSE-SU-2021:1765-1

  • libX11 openSUSE Tumbleweed 1.7.2-1.2
  • libX11 openSUSE Leap 15.3 1.6.5-3.21.1
  • libX11 openSUSE Leap 15.2 1.6.5-lp152.5.18.1
  • libX11 openSUSE Leap 15.2 1.6.5-lp152.5.15.1

opensuse advisories openSUSE-SU-2024:10918-1openSUSE-SU-2021:1897-1openSUSE-SU-2021:0857-1openSUSE-SU-2021:0807-1

  • libX11 AlmaLinux 8 1.6.8-5.el8
  • libX11-xcb AlmaLinux 8 1.6.8-5.el8
  • libX11-common AlmaLinux 8 1.6.8-5.el8

almalinux advisories ALSA-2021:4326

  • libX11 Rocky Linux 8 1.6.8-5.el8

rocky linux advisories RLSA-2021:4326

  • libx11 Alpine 3.12, Alpine 3.11, Alpine 3.10 1.6.12-r1
  • libx11 Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.7.1-r0

alpine advisories ALPINE-CVE-2021-31535

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libx11 Arch Linux 1.7.1-1

arch linux advisories AVG-1968

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-31535 updated cvss 8.1

libX11: missing request length checks

  • Red Hat Enterprise Linux 6 libX11, libX11-common
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Ansible Tower 3.8 for RHEL 7 ansible-tower-38/ansible-tower-rhel7 3.8.4-1
    fixed: vendor fix RHBA-2021:3472
  • Red Hat Enterprise Linux AppStream (v. 8) libX11 1.6.8-5.el8, libX11-xcb 1.6.8-5.el8, libX11-common 1.6.8-5.el8
    fixed: vendor fix RHSA-2021:4326
  • Red Hat Enterprise Linux Client (v. 7) libX11 1.6.7-4.el7_9, libX11-common 1.6.7-4.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) libX11-devel 1.6.7-4.el7_9, libX11-debuginfo 1.6.7-4.el7_9 Red Hat Enterprise Linux Server (v. 7) libX11 1.6.7-4.el7_9, libX11-common 1.6.7-4.el7_9 Red Hat Enterprise Linux Workstation (v. 7) libX11 1.6.7-4.el7_9, libX11-common 1.6.7-4.el7_9
    fixed: vendor fix RHSA-2021:3296
  • Red Hat Virtualization 4 Hypervisor for RHEL 7 redhat-virtualization-host 4.3.18-20210903.0.el7_9, redhat-virtualization-host-image-update 4.3.18-20210903.0.el7_9 Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-virtualization-host 4.3.18-20210903.0.el7_9, redhat-virtualization-host-image-update 4.3.18-20210903.0.el7_9
    fixed: vendor fix RHSA-2021:3477
  • Red Hat Enterprise Linux 9 libX11, libX11-xcb, libX11-common Red Hat RHEL 7-based RHEV-H for RHEV 4 (build requirements) redhat-release-virtualization-host 4.3.18-1.el7ev, redhat-virtualization-host-image-update-placeholder 4.3.18-1.el7ev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

10.35% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • unparalleled.eu https://unparalleled.eu/publications/2021/advisory-unpar-2021-1.txt referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/162737/libX11-Insufficient-Length-Check-Injection.html referenced PoC, tagged "exploit" by a source, unverified
  • unparalleled.eu https://unparalleled.eu/blog/2021/20210518-using-xterm-to-navigate-the-huge-color-space/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P
OSV 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia Xorg_libX11_jll
<1.8.6+0
1.8.6+0

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.