A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xorg-x11-server-develUpgrade tigervnc-server-moduleUpgrade tigervnc-licenseUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade tigervnc-selinuxUpgrade tigervncUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XvfbUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-iconsUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade tigervnc-serverUpgrade xorg-x11-server-Xdmx | May 15, 2023 | Dec 14, 2022 |
| Alpine Linux | — | Upgrade xwaylandUpgrade xorg-server | Aug 22, 2024 | Dec 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xwayland | May 28, 2024 | Dec 14, 2022 |
| Amazon_linux | — | Upgrade xorg-x11-server | Feb 23, 2023 | Dec 14, 2022 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-develUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xorg-debuginfo | Feb 17, 2025 | Dec 14, 2022 |
| Centos_linux | — | Upgrade xorg-x11-server-commonUpgrade tigervncUpgrade xorg-x11-server-develUpgrade tigervnc-licenseUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XdmxUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XorgUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-debuginfoUpgrade tigervnc-iconsUpgrade tigervnc-server-appletUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-source | Jan 12, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade xwaylandUpgrade xorg-server | Dec 22, 2022 | Dec 14, 2022 |
| Freebsd | — | Upgrade xwaylandUpgrade xorg-nestserverUpgrade xorg-serverUpgrade xwayland-develUpgrade xorg-vfbserverUpgrade xephyr | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | May 31, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 20, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | May 8, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Jun 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Feb 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Jul 10, 2023 | Dec 14, 2022 |
| Oracle_linux | — | Upgrade tigervnc-server-minimalUpgrade tigervnc-server-moduleUpgrade tigervnc-iconsUpgrade tigervnc-server-appletUpgrade tigervnc-serverUpgrade tigervnc-selinuxUpgrade tigervnc-licenseUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XephyrUpgrade tigervncUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-common | Jan 10, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XvfbUpgrade tigervncUpgrade tigervnc-debugsourceUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-develUpgrade tigervnc-server-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoNo solution existsUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-selinuxUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade tigervnc-server-minimalUpgrade tigervnc-serverUpgrade tigervnc-iconsUpgrade tigervnc-licenseUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-server-appletUpgrade xorg-x11-server-Xorg | Jan 12, 2023 | Dec 14, 2022 |
| Suse | — | Upgrade xorg-x11-server-sourceUpgrade xorg-x11-server-sdkUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-waylandUpgrade xorg-x11-server-extraUpgrade xorg-x11-serverUpgrade xwayland-develUpgrade xwayland | Dec 15, 2022 | Dec 14, 2022 |
| Ubuntu | — | Upgrade xserver-xorg-core-hwe-16.04 (Ubuntu Pro)Upgrade xwayland-hwe-16.04 (Ubuntu Pro)Upgrade xserver-xorg-coreUpgrade xwaylandUpgrade xserver-xorg-core-hwe-18.04Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xwayland-hwe-18.04Upgrade xwayland (Ubuntu Pro) | Dec 15, 2022 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub