A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervnc-server-minimalUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-serverUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XorgUpgrade tigervnc-selinuxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-develUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade tigervncUpgrade tigervnc-licenseUpgrade xorg-x11-server-XephyrUpgrade tigervnc-server-moduleUpgrade tigervnc-iconsUpgrade xorg-x11-server-Xdmx | May 15, 2023 | Dec 14, 2022 |
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | Aug 22, 2024 | Dec 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-develUpgrade xorg-x11-server-debuginfo | May 28, 2024 | Dec 14, 2022 |
| Amazon_linux | — | Upgrade xorg-x11-server | Feb 23, 2023 | Dec 14, 2022 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-XnestUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xvfb | Feb 17, 2025 | Dec 14, 2022 |
| Centos_linux | — | Upgrade tigervnc-iconsUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XorgUpgrade tigervnc-serverUpgrade xorg-x11-server-XnestUpgrade tigervnc-server-appletUpgrade tigervnc-server-minimalUpgrade tigervnc-licenseUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-develUpgrade xorg-x11-server-sourceUpgrade tigervncUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade tigervnc-debuginfo | Jan 12, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade xorg-serverUpgrade xwayland | Dec 22, 2022 | Dec 14, 2022 |
| Freebsd | — | Upgrade xorg-nestserverUpgrade xwaylandUpgrade xwayland-develUpgrade xorg-vfbserverUpgrade xorg-serverUpgrade xephyr | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade x11-base/xwayland.Upgrade x11-base/xorg-server. | May 31, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 20, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | May 8, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Jun 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Feb 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Jul 10, 2023 | Dec 14, 2022 |
| Oracle_linux | — | Upgrade xorg-x11-server-XvfbUpgrade tigervnc-server-appletUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-selinuxUpgrade tigervnc-server-moduleUpgrade tigervnc-server-minimalUpgrade tigervnc-iconsUpgrade xorg-x11-server-commonUpgrade tigervncUpgrade tigervnc-licenseUpgrade xorg-x11-server-XnestUpgrade tigervnc-serverUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-source | Jan 10, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade tigervnc-selinuxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XdmxUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade tigervncUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-develUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XnestUpgrade tigervnc-licenseUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-server-appletUpgrade tigervnc-iconsUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-server-moduleUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-Xnest-debuginfoNo solution exists | Jan 12, 2023 | Dec 14, 2022 |
| Suse | — | Upgrade xwaylandUpgrade xorg-x11-server-extraUpgrade xorg-x11-server-sourceUpgrade xwayland-develUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-waylandUpgrade xorg-x11-serverUpgrade xorg-x11-server-sdk | Dec 15, 2022 | Dec 14, 2022 |
| Ubuntu | — | Upgrade xwaylandUpgrade xwayland (Ubuntu Pro)Upgrade xserver-xorg-core-hwe-16.04 (Ubuntu Pro)Upgrade xwayland-hwe-18.04Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xserver-xorg-core-hwe-18.04Upgrade xwayland-hwe-16.04 (Ubuntu Pro)Upgrade xserver-xorg-core | Dec 15, 2022 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub