[SECURITY] [DLA 3256-1] xorg-server security update

2022-12-3112:45:53

lists.debian.org

xorg-server

2:1.20.4-1+deb10u7

cve-2022-4283

privilege escalation

debian 10 buster

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

9.6

Confidence

High

EPSS

0.104

Percentile

95.1%

JSON

Debian LTS Advisory DLA-3256-1 [email protected]
https://www.debian.org/lts/security/ Thorsten Alteholz
December 31, 2022 https://wiki.debian.org/LTS

Package : xorg-server
Version : 2:1.20.4-1+deb10u7
CVE ID : CVE-2022-4283 CVE-2022-46340 CVE-2022-46341
CVE-2022-46342 CVE-2022-46343 CVE-2022-46344

Jan-Niklas Sohn discovered several vulnerabilities in X server extensions
in the X.Org X server, which may result in privilege escalation if the X
server is running privileged.

For Debian 10 buster, these problems have been fixed in version
2:1.20.4-1+deb10u7.

We recommend that you upgrade your xorg-server packages.

For the detailed security status of xorg-server please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/xorg-server

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11mips64elxserver-xorg-dev< 2:1.20.11-1+deb11u4xserver-xorg-dev_2:1.20.11-1+deb11u4_mips64el.deb
Debian10armhfxvfb< 2:1.20.4-1+deb10u7xvfb_2:1.20.4-1+deb10u7_armhf.deb
Debian10armhfxwayland< 2:1.20.4-1+deb10u7xwayland_2:1.20.4-1+deb10u7_armhf.deb
Debian11s390xxserver-xorg-core< 2:1.20.11-1+deb11u4xserver-xorg-core_2:1.20.11-1+deb11u4_s390x.deb
Debian11amd64xdmx< 2:1.20.11-1+deb11u4xdmx_2:1.20.11-1+deb11u4_amd64.deb
Debian11mipselxserver-xorg-legacy< 2:1.20.11-1+deb11u4xserver-xorg-legacy_2:1.20.11-1+deb11u4_mipsel.deb
Debian11amd64xdmx-tools< 2:1.20.11-1+deb11u4xdmx-tools_2:1.20.11-1+deb11u4_amd64.deb
Debian11armhfxserver-xorg-legacy-dbgsym< 2:1.20.11-1+deb11u4xserver-xorg-legacy-dbgsym_2:1.20.11-1+deb11u4_armhf.deb
Debian11s390xxserver-xorg-core-udeb< 2:1.20.11-1+deb11u4xserver-xorg-core-udeb_2:1.20.11-1+deb11u4_s390x.deb
Debian11armhfxdmx-dbgsym< 2:1.20.11-1+deb11u4xdmx-dbgsym_2:1.20.11-1+deb11u4_armhf.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	mips64el	xserver-xorg-dev	< 2:1.20.11-1+deb11u4	xserver-xorg-dev_2:1.20.11-1+deb11u4_mips64el.deb
Debian	10	armhf	xvfb	< 2:1.20.4-1+deb10u7	xvfb_2:1.20.4-1+deb10u7_armhf.deb
Debian	10	armhf	xwayland	< 2:1.20.4-1+deb10u7	xwayland_2:1.20.4-1+deb10u7_armhf.deb
Debian	11	s390x	xserver-xorg-core	< 2:1.20.11-1+deb11u4	xserver-xorg-core_2:1.20.11-1+deb11u4_s390x.deb
Debian	11	amd64	xdmx	< 2:1.20.11-1+deb11u4	xdmx_2:1.20.11-1+deb11u4_amd64.deb
Debian	11	mipsel	xserver-xorg-legacy	< 2:1.20.11-1+deb11u4	xserver-xorg-legacy_2:1.20.11-1+deb11u4_mipsel.deb
Debian	11	amd64	xdmx-tools	< 2:1.20.11-1+deb11u4	xdmx-tools_2:1.20.11-1+deb11u4_amd64.deb
Debian	11	armhf	xserver-xorg-legacy-dbgsym	< 2:1.20.11-1+deb11u4	xserver-xorg-legacy-dbgsym_2:1.20.11-1+deb11u4_armhf.deb
Debian	11	s390x	xserver-xorg-core-udeb	< 2:1.20.11-1+deb11u4	xserver-xorg-core-udeb_2:1.20.11-1+deb11u4_s390x.deb
Debian	11	armhf	xdmx-dbgsym	< 2:1.20.11-1+deb11u4	xdmx-dbgsym_2:1.20.11-1+deb11u4_armhf.deb