CVE-2015-3164

xorg-x11-server: Xwayland allows unconditional open access to display

Loading…

Severity

Important

Red Hat Product Security

5.1

CVSS 2.0

Review impact separately from score.

Published · June 10, 2015

Updated · November 21, 2025

Description

The authentication setup in XWayland 1.16.x and 1.17.x before 1.17.2 starts the server in non-authenticating mode, which allows local users to read from or send information to arbitrary X11 clients via vectors involving a UNIX socket.

Statement

Not vulnerable. This issue did not affect the versions of xorg-x11-server as shipped with Red Hat Enterprise Linux 5, 6, and 7.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 2.0 · 5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P

CWE-287 · Improper Authentication