A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervnc-server-moduleUpgrade tigervnc-licenseUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-develUpgrade tigervncUpgrade xorg-x11-server-sourceUpgrade tigervnc-selinuxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-iconsUpgrade xorg-x11-server-XdmxUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade tigervnc-server | May 15, 2023 | Dec 14, 2022 |
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | Aug 22, 2024 | Dec 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-develUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xwayland | May 28, 2024 | Dec 14, 2022 |
| Amazon_linux | — | Upgrade xorg-x11-server | Feb 23, 2023 | Dec 14, 2022 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xnest-debuginfo | Feb 17, 2025 | Dec 14, 2022 |
| Centos_linux | — | Upgrade xorg-x11-server-XwaylandUpgrade tigervnc-server-moduleUpgrade tigervncUpgrade xorg-x11-server-XnestUpgrade tigervnc-serverUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-develUpgrade xorg-x11-server-commonUpgrade tigervnc-licenseUpgrade xorg-x11-server-XdmxUpgrade tigervnc-server-appletUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade tigervnc-debuginfoUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-sourceUpgrade tigervnc-icons | Jan 12, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade xwaylandUpgrade xorg-server | Dec 22, 2022 | Dec 14, 2022 |
| Freebsd | — | Upgrade xephyrUpgrade xorg-serverUpgrade xwaylandUpgrade xorg-vfbserverUpgrade xorg-nestserverUpgrade xwayland-devel | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | May 31, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 20, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | May 8, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Jun 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Feb 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Jul 10, 2023 | Dec 14, 2022 |
| Oracle_linux | — | Upgrade tigervnc-serverUpgrade tigervnc-server-moduleUpgrade tigervnc-server-minimalUpgrade tigervnc-server-appletUpgrade tigervnc-iconsUpgrade tigervnc-selinuxUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XnestUpgrade tigervncUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade tigervnc-licenseUpgrade xorg-x11-server-devel | Jan 10, 2023 | Dec 14, 2022 |
| Redhat_linux | — | No solution existsUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-sourceUpgrade tigervnc-debugsourceUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XvfbUpgrade tigervnc-server-moduleUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xorg-debuginfoUpgrade tigervncUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade tigervnc-serverUpgrade tigervnc-iconsUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade tigervnc-licenseUpgrade tigervnc-server-appletUpgrade tigervnc-selinuxUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-server-minimal | Jan 12, 2023 | Dec 14, 2022 |
| Suse | — | Upgrade xorg-x11-serverUpgrade xorg-x11-server-waylandUpgrade xorg-x11-server-extraUpgrade xwaylandUpgrade xwayland-develUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-sdkUpgrade xorg-x11-server-Xvfb | Dec 15, 2022 | Dec 14, 2022 |
| Ubuntu | — | Upgrade xwaylandUpgrade xserver-xorg-core-hwe-18.04Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xwayland (Ubuntu Pro)Upgrade xwayland-hwe-18.04Upgrade xserver-xorg-core-hwe-16.04 (Ubuntu Pro)Upgrade xwayland-hwe-16.04 (Ubuntu Pro)Upgrade xserver-xorg-core | Dec 15, 2022 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub