A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xorg-x11-server-develUpgrade tigervnc-iconsUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-sourceUpgrade tigervnc-selinuxUpgrade tigervncUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade tigervnc-licenseUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-serverUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-minimal | May 15, 2023 | Dec 14, 2022 |
| Alpine Linux | — | Upgrade xwaylandUpgrade xorg-server | Aug 22, 2024 | Dec 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xdmx | May 28, 2024 | Dec 14, 2022 |
| Amazon_linux | — | Upgrade xorg-x11-server | Feb 23, 2023 | Dec 14, 2022 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-develUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-debuginfo | Feb 17, 2025 | Dec 14, 2022 |
| Centos_linux | — | Upgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XdmxUpgrade tigervncUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-sourceUpgrade tigervnc-licenseUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-XorgUpgrade tigervnc-serverUpgrade tigervnc-iconsUpgrade tigervnc-server-appletUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XnestUpgrade tigervnc-server-minimal | Jan 12, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade xorg-serverUpgrade xwayland | Dec 22, 2022 | Dec 14, 2022 |
| Freebsd | — | Upgrade xephyrUpgrade xorg-nestserverUpgrade xwaylandUpgrade xwayland-develUpgrade xorg-serverUpgrade xorg-vfbserver | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade x11-base/xwayland.Upgrade x11-base/xorg-server. | May 31, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 20, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | May 8, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Jun 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Feb 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Jul 10, 2023 | Dec 14, 2022 |
| Oracle_linux | — | Upgrade tigervnc-selinuxUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-commonUpgrade tigervnc-iconsUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-appletUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-develUpgrade tigervnc-serverUpgrade xorg-x11-server-XephyrUpgrade tigervncUpgrade xorg-x11-server-XdmxUpgrade tigervnc-licenseUpgrade xorg-x11-server-Xnest | Jan 10, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade tigervnc-serverUpgrade tigervnc-debugsourceUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoNo solution existsUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-server-appletUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-debugsourceUpgrade tigervnc-iconsUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XdmxUpgrade tigervnc-licenseUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-develUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade tigervncUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade tigervnc-selinuxUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade tigervnc-server-debuginfo | Jan 12, 2023 | Dec 14, 2022 |
| Suse | — | Upgrade xorg-x11-server-sourceUpgrade xorg-x11-server-waylandUpgrade xorg-x11-server-sdkUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-serverUpgrade xwayland-develUpgrade xwaylandUpgrade xorg-x11-server-extra | Dec 15, 2022 | Dec 14, 2022 |
| Ubuntu | — | Upgrade xserver-xorg-core-hwe-18.04Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xserver-xorg-core-hwe-16.04 (Ubuntu Pro)Upgrade xwayland-hwe-16.04 (Ubuntu Pro)Upgrade xwayland-hwe-18.04Upgrade xserver-xorg-coreUpgrade xwayland (Ubuntu Pro)Upgrade xwayland | Dec 15, 2022 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub