A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XdmxUpgrade tigervnc-serverUpgrade tigervnc-iconsUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade tigervncUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-sourceUpgrade tigervnc-licenseUpgrade xorg-x11-server-develUpgrade tigervnc-selinuxUpgrade tigervnc-server-module | May 15, 2023 | Dec 14, 2022 |
| Alpine Linux | — | Upgrade xwaylandUpgrade xorg-server | Aug 22, 2024 | Dec 14, 2022 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-XorgUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-develUpgrade xorg-x11-server-common | May 28, 2024 | Dec 14, 2022 |
| Amazon_linux | — | Upgrade xorg-x11-server | Feb 23, 2023 | Dec 14, 2022 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xvfb-debuginfo | Feb 17, 2025 | Dec 14, 2022 |
| Centos_linux | — | Upgrade tigervnc-server-minimalUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-sourceUpgrade tigervnc-iconsUpgrade tigervnc-server-appletUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XorgUpgrade tigervnc-serverUpgrade tigervnc-licenseUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade tigervncUpgrade xorg-x11-server-devel | Jan 12, 2023 | Dec 14, 2022 |
| Debian | — | Upgrade xwaylandUpgrade xorg-server | Dec 22, 2022 | Dec 14, 2022 |
| Freebsd | — | Upgrade xephyrUpgrade xorg-nestserverUpgrade xorg-vfbserverUpgrade xwayland-develUpgrade xwaylandUpgrade xorg-server | Jan 13, 2023 | Jan 11, 2023 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | May 31, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 20, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | May 8, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Jun 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Feb 9, 2023 | Dec 14, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Jul 10, 2023 | Dec 14, 2022 |
| Oracle_linux | — | Upgrade tigervnc-serverUpgrade tigervnc-selinuxUpgrade tigervnc-server-moduleUpgrade tigervnc-iconsUpgrade tigervnc-server-minimalUpgrade tigervnc-server-appletUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XephyrUpgrade tigervncUpgrade xorg-x11-server-sourceUpgrade tigervnc-licenseUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-common | Jan 10, 2023 | Dec 14, 2022 |
| Redhat_linux | — | Upgrade xorg-x11-server-XorgUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XnestUpgrade tigervnc-serverUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-server-appletUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade tigervnc-licenseUpgrade tigervnc-iconsUpgrade tigervnc-selinuxUpgrade tigervncUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-debugsourceUpgrade tigervnc-debuginfoUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade tigervnc-server-minimal-debuginfoNo solution existsUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-develUpgrade tigervnc-server-debuginfo | Jan 12, 2023 | Dec 14, 2022 |
| Suse | — | Upgrade xorg-x11-server-sdkUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-extraUpgrade xwayland-develUpgrade xorg-x11-serverUpgrade xorg-x11-server-waylandUpgrade xwayland | Dec 15, 2022 | Dec 14, 2022 |
| Ubuntu | — | Upgrade xserver-xorg-coreUpgrade xwayland-hwe-16.04 (Ubuntu Pro)Upgrade xserver-xorg-core-hwe-16.04 (Ubuntu Pro)Upgrade xwaylandUpgrade xwayland (Ubuntu Pro)Upgrade xwayland-hwe-18.04Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xserver-xorg-core-hwe-18.04 | Dec 15, 2022 | Dec 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub