A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xorg-x11-server-XwaylandUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-commonUpgrade tigervncUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XephyrUpgrade tigervnc-iconsUpgrade tigervnc-selinuxUpgrade xorg-x11-server-sourceUpgrade tigervnc-licenseUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xvfb | May 15, 2023 | Dec 14, 2022 |
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | Aug 22, 2024 | Dec 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-devel | May 28, 2024 | Dec 14, 2022 |
| Amazon_linux | — | Upgrade xorg-x11-server | Feb 23, 2023 | Dec 14, 2022 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-devel | Feb 17, 2025 | Dec 14, 2022 |
| Centos_linux | — | Upgrade xorg-x11-server-debuginfoUpgrade tigervnc-debuginfoUpgrade tigervnc-server-moduleUpgrade tigervncUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade tigervnc-licenseUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-iconsUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-minimalUpgrade tigervnc-serverUpgrade tigervnc-server-applet | Jan 12, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade xwaylandUpgrade xorg-server | Dec 22, 2022 | Dec 14, 2022 |
| Freebsd | — | Upgrade xwayland-develUpgrade xorg-nestserverUpgrade xorg-vfbserverUpgrade xorg-serverUpgrade xwaylandUpgrade xephyr | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade x11-base/xwayland.Upgrade x11-base/xorg-server. | May 31, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 20, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | May 8, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Jun 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Feb 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Jul 10, 2023 | Dec 14, 2022 |
| Oracle_linux | — | Upgrade xorg-x11-server-XwaylandUpgrade tigervnc-selinuxUpgrade xorg-x11-server-XvfbUpgrade tigervnc-iconsUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-appletUpgrade tigervnc-server-moduleUpgrade tigervnc-server-minimalUpgrade tigervncUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XdmxUpgrade tigervnc-licenseUpgrade tigervnc-serverUpgrade xorg-x11-server-develUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xnest | Jan 10, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade tigervnc-serverUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-debugsourceUpgrade tigervnc-server-moduleNo solution existsUpgrade tigervnc-iconsUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-server-minimalUpgrade tigervnc-server-appletUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade tigervnc-selinuxUpgrade xorg-x11-server-commonUpgrade tigervncUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-licenseUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XdmxUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-devel | Jan 12, 2023 | Dec 14, 2022 |
| Suse | — | Upgrade xorg-x11-server-waylandUpgrade xorg-x11-server-sourceUpgrade xorg-x11-serverUpgrade xwayland-develUpgrade xorg-x11-server-sdkUpgrade xorg-x11-server-XvfbUpgrade xwaylandUpgrade xorg-x11-server-extra | Dec 15, 2022 | Dec 14, 2022 |
| Ubuntu | — | Upgrade xwayland (Ubuntu Pro)Upgrade xwaylandUpgrade xwayland-hwe-18.04Upgrade xserver-xorg-coreUpgrade xwayland-hwe-16.04 (Ubuntu Pro)Upgrade xserver-xorg-core-hwe-16.04 (Ubuntu Pro)Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xserver-xorg-core-hwe-18.04 | Dec 15, 2022 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub