Lucene search

K
freebsdFreeBSD9FA7B139-C1E9-409E-BED0-006AADCF5845
HistoryDec 14, 2022 - 12:00 a.m.

xorg-server -- Multiple security issues in X server extensions

2022-12-1400:00:00
vuxml.freebsd.org
5

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.028 Low

EPSS

Percentile

90.7%

The X.org project reports:

CVE-2022-46340/ZDI-CAN-19265: X.Org Server XTestSwapFakeInput stack
overflow

    The swap handler for the XTestFakeInput request of the XTest extension
    may corrupt the stack if GenericEvents with lengths larger than 32 bytes
    are sent through a the XTestFakeInput request.

This issue does not affect systems where client and server use the same
byte order.
CVE-2022-46341/ZDI-CAN-19381: X.Org Server XIPassiveUngrab
out-of-bounds access

    The handler for the XIPassiveUngrab request accesses out-of-bounds
    memory when invoked with a high keycode or button code.

CVE-2022-46342/ZDI-CAN-19400: X.Org Server XvdiSelectVideoNotify
use-after-free

    The handler for the XvdiSelectVideoNotify request may write to memory
    after it has been freed.

CVE-2022-46343/ZDI-CAN-19404: X.Org Server ScreenSaverSetAttributes
use-after-free

    The handler for the ScreenSaverSetAttributes request may write to memory
    after it has been freed.

CVE-2022-46344/ZDI-CAN-19405: X.Org Server XIChangeProperty
out-of-bounds access

    The handler for the XIChangeProperty request has a length-validation
    issues, resulting in out-of-bounds memory reads and potential
    information disclosure.

CVE-2022-4283/ZDI-CAN-19530: X.Org Server XkbGetKbdByName use-after-free

    The XkbCopyNames function left a dangling pointer to freed memory,
    resulting in out-of-bounds memory access on subsequent XkbGetKbdByName
    requests.

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

0.028 Low

EPSS

Percentile

90.7%