A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervnc-server-moduleUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-develUpgrade tigervnc-selinuxUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-sourceUpgrade tigervnc-licenseUpgrade xorg-x11-server-commonUpgrade tigervncUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-serverUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XdmxUpgrade tigervnc-server-minimalUpgrade tigervnc-iconsUpgrade xorg-x11-server-Xorg | May 15, 2023 | Dec 14, 2022 |
| Alpine Linux | — | Upgrade xwaylandUpgrade xorg-server | Aug 22, 2024 | Dec 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-devel | May 28, 2024 | Dec 14, 2022 |
| Amazon_linux | — | Upgrade xorg-x11-server | Feb 23, 2023 | Dec 14, 2022 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xephyr | Feb 17, 2025 | Dec 14, 2022 |
| Centos_linux | — | Upgrade tigervnc-server-moduleUpgrade tigervnc-serverUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-commonUpgrade tigervnc-licenseUpgrade xorg-x11-server-XdmxUpgrade tigervncUpgrade xorg-x11-server-sourceUpgrade tigervnc-server-minimalUpgrade tigervnc-debuginfoUpgrade tigervnc-server-appletUpgrade tigervnc-iconsUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xephyr | Jan 12, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade xwaylandUpgrade xorg-server | Dec 22, 2022 | Dec 14, 2022 |
| Freebsd | — | Upgrade xorg-nestserverUpgrade xorg-vfbserverUpgrade xwaylandUpgrade xorg-serverUpgrade xwayland-develUpgrade xephyr | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade x11-base/xwayland.Upgrade x11-base/xorg-server. | May 31, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 20, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | May 8, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Jun 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Feb 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Jul 10, 2023 | Dec 14, 2022 |
| Oracle_linux | — | Upgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-develUpgrade tigervncUpgrade tigervnc-licenseUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XnestUpgrade tigervnc-serverUpgrade tigervnc-iconsUpgrade tigervnc-server-moduleUpgrade tigervnc-server-minimalUpgrade tigervnc-server-appletUpgrade tigervnc-selinux | Jan 10, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoNo solution existsUpgrade tigervnc-server-debuginfoUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-XephyrUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-develUpgrade tigervncUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XnestUpgrade tigervnc-iconsUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XorgUpgrade tigervnc-serverUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade tigervnc-licenseUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-selinuxUpgrade tigervnc-server-appletUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xwayland | Jan 12, 2023 | Dec 14, 2022 |
| Suse | — | Upgrade xorg-x11-server-sourceUpgrade xorg-x11-server-sdkUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-waylandUpgrade xwaylandUpgrade xorg-x11-server-extraUpgrade xwayland-develUpgrade xorg-x11-server | Dec 15, 2022 | Dec 14, 2022 |
| Ubuntu | — | Upgrade xserver-xorg-core-hwe-16.04 (Ubuntu Pro)Upgrade xserver-xorg-coreUpgrade xwayland-hwe-16.04 (Ubuntu Pro)Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xwayland-hwe-18.04Upgrade xwaylandUpgrade xserver-xorg-core-hwe-18.04Upgrade xwayland (Ubuntu Pro) | Dec 15, 2022 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub