A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervncUpgrade xorg-x11-server-commonUpgrade tigervnc-selinuxUpgrade tigervnc-licenseUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XephyrUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-iconsUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XdmxUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-Xorg | May 15, 2023 | Dec 14, 2022 |
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | Aug 22, 2024 | Dec 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xnest | May 28, 2024 | Dec 14, 2022 |
| Amazon_linux | — | Upgrade xorg-x11-server | Feb 23, 2023 | Dec 14, 2022 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-XorgUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-develUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xvfb-debuginfo | Feb 17, 2025 | Dec 14, 2022 |
| Centos_linux | — | Upgrade tigervncUpgrade tigervnc-licenseUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-commonUpgrade tigervnc-serverUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-develUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade tigervnc-debuginfoUpgrade tigervnc-server-appletUpgrade tigervnc-iconsUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xvfb | Jan 12, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade xorg-serverUpgrade xwayland | Dec 22, 2022 | Dec 14, 2022 |
| Freebsd | — | Upgrade xephyrUpgrade xorg-vfbserverUpgrade xwaylandUpgrade xwayland-develUpgrade xorg-nestserverUpgrade xorg-server | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | May 31, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 20, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | May 8, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Jun 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Feb 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Jul 10, 2023 | Dec 14, 2022 |
| Oracle_linux | — | Upgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade tigervnc-server-moduleUpgrade tigervnc-selinuxUpgrade tigervnc-iconsUpgrade tigervnc-server-appletUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XwaylandUpgrade tigervncUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XephyrUpgrade tigervnc-licenseUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-source | Jan 10, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade tigervncUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XdmxUpgrade tigervnc-debugsourceUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-server-moduleUpgrade tigervnc-debuginfoUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-Xnest-debuginfoNo solution existsUpgrade xorg-x11-server-sourceUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade tigervnc-server-appletUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade tigervnc-selinuxUpgrade tigervnc-licenseUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade tigervnc-serverUpgrade tigervnc-icons | Jan 12, 2023 | Dec 14, 2022 |
| Suse | — | Upgrade xwaylandUpgrade xwayland-develUpgrade xorg-x11-server-waylandUpgrade xorg-x11-serverUpgrade xorg-x11-server-extraUpgrade xorg-x11-server-sdkUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xvfb | Dec 15, 2022 | Dec 14, 2022 |
| Ubuntu | — | Upgrade xwayland (Ubuntu Pro)Upgrade xwayland-hwe-18.04Upgrade xwaylandUpgrade xserver-xorg-core-hwe-18.04Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xserver-xorg-coreUpgrade xserver-xorg-core-hwe-16.04 (Ubuntu Pro)Upgrade xwayland-hwe-16.04 (Ubuntu Pro) | Dec 15, 2022 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub