A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervnc-server-moduleUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-develUpgrade tigervnc-licenseUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XephyrUpgrade tigervncUpgrade tigervnc-selinuxUpgrade xorg-x11-server-XvfbUpgrade tigervnc-iconsUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-serverUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xnest | May 15, 2023 | Dec 14, 2022 |
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | Aug 22, 2024 | Dec 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-debuginfo | May 28, 2024 | Dec 14, 2022 |
| Amazon_linux | — | Upgrade xorg-x11-server | Feb 23, 2023 | Dec 14, 2022 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-develUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-debuginfo | Feb 17, 2025 | Dec 14, 2022 |
| Centos_linux | — | Upgrade xorg-x11-server-XorgUpgrade tigervnc-serverUpgrade xorg-x11-server-develUpgrade tigervncUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XnestUpgrade tigervnc-licenseUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XdmxUpgrade tigervnc-iconsUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-sourceUpgrade tigervnc-server-minimalUpgrade tigervnc-server-appletUpgrade xorg-x11-server-debuginfo | Jan 12, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade xorg-serverUpgrade xwayland | Dec 22, 2022 | Dec 14, 2022 |
| Freebsd | — | Upgrade xephyrUpgrade xwayland-develUpgrade xorg-serverUpgrade xorg-vfbserverUpgrade xwaylandUpgrade xorg-nestserver | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | May 31, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 20, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | May 8, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Jun 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Feb 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Jul 10, 2023 | Dec 14, 2022 |
| Oracle_linux | — | Upgrade tigervnc-server-appletUpgrade tigervnc-server-minimalUpgrade tigervnc-iconsUpgrade tigervnc-server-moduleUpgrade tigervnc-serverUpgrade tigervnc-selinuxUpgrade tigervncUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-sourceUpgrade tigervnc-license | Jan 10, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade xorg-x11-server-debugsourceUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-develNo solution existsUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-sourceUpgrade tigervncUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-XvfbUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-Xorg-debuginfoUpgrade tigervnc-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade tigervnc-iconsUpgrade tigervnc-server-appletUpgrade tigervnc-selinuxUpgrade tigervnc-licenseUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-XnestUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XorgUpgrade tigervnc-server | Jan 12, 2023 | Dec 14, 2022 |
| Suse | — | Upgrade xorg-x11-server-sdkUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade xwayland-develUpgrade xwaylandUpgrade xorg-x11-server-waylandUpgrade xorg-x11-server-extraUpgrade xorg-x11-server | Dec 15, 2022 | Dec 14, 2022 |
| Ubuntu | — | Upgrade xserver-xorg-core-hwe-16.04 (Ubuntu Pro)Upgrade xserver-xorg-coreUpgrade xwayland-hwe-16.04 (Ubuntu Pro)Upgrade xwaylandUpgrade xserver-xorg-core (Ubuntu Pro)Upgrade xwayland (Ubuntu Pro)Upgrade xserver-xorg-core-hwe-18.04Upgrade xwayland-hwe-18.04 | Dec 15, 2022 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub