Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 461
Alerts This Week
Warning Icon 1 461

Ubuntu: 1714-1 Urgent: QXL Vulnerability Causes Denial Of Service

ubuntu
Calendar Grey February 5, 2013
Scroller Ubuntu
A flaw in the QXL display driver on Ubuntu allows attackers to crash guest environments; it is crucial to update all related packages to their latest versions
Guests using the QXL graphics driver could be caused to hang or crash.

Summary

Guests using the QXL graphics driver could be caused to hang or crash.

Software Description:

- xserver-xorg-video-qxl: X.Org X server -- QXL display driver

Details:

It was discovered that the QXL graphics driver incorrectly handled

terminated connections. An attacker that could connect to a guest using

SPICE and the QXL graphics driver could cause the guest to hang or crash,

resulting in a denial of service.

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu xserver-xorg-video-qxl

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  xserver-xorg-video-qxl          0.0.16-2ubuntu0.1

Ubuntu 11.10:
  xserver-xorg-video-qxl          0.0.14-1ubuntu0.1

After a standard system update you need to reboot your computer to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1714-1

CVE-2013-0241

Severity
critical
Lowest
Low
Medium
High
Critical

February 05, 2013

Topics%20covered

Topics Covered

security advisory denial of service critical ubuntu xserver-xorg-video-qxl

Package Information

https://launchpad.net/ubuntu/+source/xserver-xorg-video-qxl/0.0.16-2ubuntu0.1
https://launchpad.net/ubuntu/+source/xserver-xorg-video-qxl/0.0.14-1ubuntu0.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.