CVE-2015-8316: Out-of-bounds Read
Array index error in LightDM (aka Light Display Manager) 1.14.3, 1.16.x before 1.16.6 when the XDMCP server is enabled allows remote attackers to cause a denial of service (process crash) via an XDMCP request packet with no address.
Other sources
It was found that when XDMCP sercer is enabled and LightDM receives an XDMCP Request packet with no addresses, it will attempt to access a negative index into an array, causing denial of service.
CVE assignment:
http://seclists.org/oss-sec/2015/q4/352
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-8316?
CVE-2015-8316 has a severity rating that allows remote attackers to cause a denial of service due to an array index error.
How do I fix CVE-2015-8316?
To fix CVE-2015-8316, update LightDM to version 1.16.6 or later.
Which versions of LightDM are affected by CVE-2015-8316?
LightDM versions 1.14.3 and all 1.16.x versions prior to 1.16.6 are affected by CVE-2015-8316.
What kind of attack does CVE-2015-8316 enable?
CVE-2015-8316 enables remote attackers to initiate a denial of service attack resulting in a process crash.
Is the XDMCP server related to the CVE-2015-8316 vulnerability?
Yes, the vulnerability occurs when the XDMCP server is enabled in LightDM.