BlackTreeIndependent security intelligenceUnknown · Unknown
Medium technical severity with no CISA KEV confirmation; remediate through the normal risk-based patch cycle unless local exposure raises the priority.
Canonical’s release and source-package findings are shown separately from local repository availability.
A published vendor fix does not prove that a matching update is enabled and installable on a particular asset. Confirm the local package candidate before scheduling remediation.
| Ubuntu release | Source package | Vendor state | Fixed version | Evidence |
|---|---|---|---|---|
| Ubuntu 24.04 LTSnoble · standard archive | libx11 | Vendor fix publishedCanonical reports that a fixed source package version has been published. Repository candidate availability is not checked by BlackTree. | 2:1.8.6-1ubuntu1 | Canonical record ↗Source updated 10 Sept 2026 |
| Ubuntu 24.04 LTSnoble · standard archive | libxpm | Vendor fix publishedCanonical reports that a fixed source package version has been published. Repository candidate availability is not checked by BlackTree. | 1:3.5.12-1.1ubuntu1 | Canonical record ↗Source updated 10 Sept 2026 |
| Ubuntu 24.04 LTSnoble · standard archive | motif | Under evaluationCanonical reports that the package might be affected and still needs evaluation or fixing. | Not published in this feed | Canonical record ↗Source updated 10 Sept 2026 |
Medium technical severity with no CISA KEV confirmation; remediate through the normal risk-based patch cycle unless local exposure raises the priority.
Patch availableA vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.
A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.
The product does not properly control the allocation and maintenance of a limited resource.
An attacker operating through local access may attempt exploitation without authentication after a user interaction. If successful, the issue may disrupt the affected service.
A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.
The product does not properly control the allocation and maintenance of a limited resource.
An attacker operating through local access may attempt exploitation without authentication after a user interaction. If successful, the issue may disrupt the affected service.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
No CISA KEV match was present at the last successful refresh. This means no confirmation from that source, not proof of no exploitation.
No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.
CWE-400: Uncontrolled Resource Consumption. The product does not properly control the allocation and maintenance of a limited resource.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 10 Oct 2023 · Last source change 6 Nov 2025, 22:59 UTC · CWE-400 · Uncontrolled Resource Consumption
Missing structured fields: affected product. Missing data is not evidence of low risk; review the primary advisory.
No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.