NVD Vulnerability Detail

CVE-2020-2656

Summary	Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Solaris accessible data as well as unauthorized read access to a subset of Oracle Solaris accessible data. CVSS 3.0 Base Score 4.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
Publication Date	Jan. 16, 2020, 2:15 a.m.
Registration Date	Jan. 26, 2021, 11:56 a.m.
Last Update	Nov. 21, 2024, 2:25 p.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/155990/Solaris-xlock-Information-Disclosure.html	Exploit Patch Third Party Advisory VDB Entry Vendor Advisory
2	http://packetstormsecurity.com/files/155990/Solaris-xlock-Information-Disclosure.html	Exploit Patch Third Party Advisory VDB Entry Vendor Advisory
3	http://seclists.org/fulldisclosure/2020/Jan/23	Exploit Mailing List Patch Third Party Advisory
4	http://seclists.org/fulldisclosure/2020/Jan/23	Exploit Mailing List Patch Third Party Advisory
5	http://www.openwall.com/lists/oss-security/2020/01/20/2	Mailing List Third Party Advisory
6	http://www.openwall.com/lists/oss-security/2020/01/20/2	Mailing List Third Party Advisory
7	https://seclists.org/bugtraq/2020/Jan/23	Exploit Mailing List Third Party Advisory
8	https://seclists.org/bugtraq/2020/Jan/23	Exploit Mailing List Third Party Advisory
9	https://www.oracle.com/security-alerts/cpujan2020.html	Patch Vendor Advisory
10	https://www.oracle.com/security-alerts/cpujan2020.html	Patch Vendor Advisory

Common Vulnerabilities List

JVN Vulnerability Information

Oracle Systems の Oracle Solaris における X Window System に関する脆弱性

Title	Oracle Systems の Oracle Solaris における X Window System に関する脆弱性
Summary	Oracle Systems の Oracle Solaris には、X Window System に関する処理に不備があるため、機密性、および完全性に影響のある脆弱性が存在します。
Possible impacts	ローカルユーザにより、情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Jan. 14, 2020, midnight
Registration Date	Jan. 30, 2020, 3 p.m.
Last Update	Jan. 30, 2020, 3 p.m.

Affected System

オラクル

Oracle Solaris 10

Oracle Solaris 11

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-2656	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-2656
National Vulnerability Database (NVD)
2	CVE-2020-2656	https://nvd.nist.gov/vuln/detail/CVE-2020-2656
関連文書
3	CVE-2020-2656 - Low impact information disclosure via Solaris xlock	http://seclists.org/fulldisclosure/2020/Jan/23

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Oracle Critical Patch Update
1	Oracle Critical Patch Update Advisory - January 2020	https://www.oracle.com/security-alerts/cpujan2020.html
2	Text Form of Oracle Critical Patch Update - January 2020 Risk Matrices	https://www.oracle.com/security-alerts/cpujan2020verbose.html

その他

No	Name	URL
関連文書
1	Solaris xlock Information Disclosure	http://packetstormsecurity.com/files/155990/Solaris-xlock-Information-Disclosure.html

Change Log

No	Changed Details	Date of change
1	[2020年01月30日] 掲載	Jan. 30, 2020, 3 p.m.