CVE-2020-14347

A flaw was found in the way xserver memory was not properly initialized. This could leak parts of server memory to the X client. In cases where Xorg server runs with elevated privileges, this could result in possible ASLR bypass. Xorg-server before version 1.20.9 is vulnerable.

• CWE-665
• CWE-665

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00066.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00075.htmlBroken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14347Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/08/msg00057.htmlMailing List, Third Party Advisory
• https://lists.x.org/archives/xorg-announce/2020-July/003051.htmlMailing List, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/202012-01Third Party Advisory
• https://usn.ubuntu.com/4488-1/Third Party Advisory
• https://usn.ubuntu.com/4488-2/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4758Third Party Advisory
• https://www.openwall.com/lists/oss-security/2020/07/31/2Mailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00066.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00075.htmlBroken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14347Issue Tracking, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/08/msg00057.htmlMailing List, Third Party Advisory
• https://lists.x.org/archives/xorg-announce/2020-July/003051.htmlMailing List, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/202012-01Third Party Advisory
• https://usn.ubuntu.com/4488-1/Third Party Advisory
• https://usn.ubuntu.com/4488-2/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4758Third Party Advisory
• https://www.openwall.com/lists/oss-security/2020/07/31/2Mailing List, Third Party Advisory

Published

Aug 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14341The "Test Connection" available in v7.x of the Red Hat Singl…2.7
• CVE-2020-14342It was found that cifs-utils' mount.cifs was invoking a shel…7
• CVE-2020-14343A vulnerability was discovered in the PyYAML library in vers…9.8
• CVE-2020-14344An integer overflow leading to a heap-buffer overflow was fo…6.7
• CVE-2020-14345A flaw was found in X.Org Server before xorg-x11-server 1.20…7.8
• CVE-2020-14346A flaw was found in xorg-x11-server before 1.20.9. An intege…7.8
• CVE-2020-14348It was found in AMQ Online before 1.5.2 that injecting an in…4.3
• CVE-2020-14349It was found that PostgreSQL versions before 12.4, before 11…7.1
• CVE-2020-1435A remote code execution vulnerability exists in the way that…8.8
• CVE-2020-14350It was found that some PostgreSQL extensions did not use sea…7.3
• CVE-2020-14351A flaw was found in the Linux kernel. A use-after-free memor…7.8
• CVE-2020-14352A flaw was found in librepo in versions before 1.12.1. A dir…8