A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervnc-server-minimalUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-serverUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade tigervnc-iconsUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-develUpgrade tigervnc-licenseUpgrade xorg-x11-server-XdmxUpgrade tigervncUpgrade xorg-x11-server-sourceUpgrade tigervnc-selinux | May 15, 2023 | Dec 14, 2022 |
| Alpine Linux | — | Upgrade xwaylandUpgrade xorg-server | Aug 22, 2024 | Dec 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-devel | May 28, 2024 | Dec 14, 2022 |
| Amazon_linux | — | Upgrade xorg-x11-server | Feb 23, 2023 | Dec 14, 2022 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfo | Feb 17, 2025 | Dec 14, 2022 |
| Centos_linux | — | Upgrade xorg-x11-server-XwaylandUpgrade tigervnc-iconsUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-minimalUpgrade tigervnc-serverUpgrade xorg-x11-server-XnestUpgrade tigervnc-server-appletUpgrade xorg-x11-server-develUpgrade xorg-x11-server-debuginfoUpgrade tigervncUpgrade xorg-x11-server-XvfbUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-sourceUpgrade tigervnc-licenseUpgrade xorg-x11-server-XephyrUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xdmx | Jan 12, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade xwaylandUpgrade xorg-server | Dec 22, 2022 | Dec 14, 2022 |
| Freebsd | — | Upgrade xephyrUpgrade xwaylandUpgrade xorg-vfbserverUpgrade xwayland-develUpgrade xorg-nestserverUpgrade xorg-server | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade x11-base/xwayland.Upgrade x11-base/xorg-server. | May 31, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 20, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | May 8, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Jun 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Feb 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Jul 10, 2023 | Dec 14, 2022 |
| Oracle_linux | — | Upgrade tigervnc-server-moduleUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XvfbUpgrade tigervnc-selinuxUpgrade tigervnc-server-appletUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-commonUpgrade tigervnc-iconsUpgrade tigervnc-serverUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XephyrUpgrade tigervncUpgrade xorg-x11-server-XdmxUpgrade tigervnc-licenseUpgrade xorg-x11-server-Xnest | Jan 10, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervncUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XdmxUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-licenseUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-develUpgrade tigervnc-selinuxUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-commonUpgrade tigervnc-server-debuginfoUpgrade tigervnc-serverUpgrade tigervnc-debugsourceUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-iconsUpgrade tigervnc-server-appletUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-debuginfoNo solution exists | Jan 12, 2023 | Dec 14, 2022 |
| Suse | — | Upgrade xwaylandUpgrade xorg-x11-server-extraUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-serverUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-waylandUpgrade xorg-x11-server-sdkUpgrade xwayland-devel | Dec 15, 2022 | Dec 14, 2022 |
| Ubuntu | — | Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xserver-xorg-core-hwe-16.04 (Ubuntu Pro)Upgrade xserver-xorg-core-hwe-18.04Upgrade xserver-xorg-coreUpgrade xwayland-hwe-16.04 (Ubuntu Pro)Upgrade xwayland-hwe-18.04Upgrade xwaylandUpgrade xwayland (Ubuntu Pro) | Dec 15, 2022 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub