Updated x11-server, x11-server-xwayland and tigervnc fix security issues

2024-02-0405:49:27

Gentoo Foundation

advisories.mageia.org

x11-server

x11-server-xwayland

tigervnc

security vulnerabilities

heap buffer overflow

devicefocusevent

procxiquerypointer

out-of-bounds memory access

xisenddevicehierarchyevent

disabledevice

selinux unlabeled glx pbuffer

selinux context corruption

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

Low

EPSS

0.004

Percentile

73.8%

JSON

The updated packages fix security vulnerabilities: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer. (CVE-2023-6816) Reattaching to different master device may lead to out-of-bounds memory access. (CVE-2024-0229) Heap buffer overflow in XISendDeviceHierarchyEvent. (CVE-2024-21885) Heap buffer overflow in DisableDevice. (CVE-2024-21886) SELinux unlabeled GLX PBuffer. (CVE-2024-0408) SELinux context corruption. (CVE-2024-0409)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchx11-server< 21.1.8-7.3x11-server-21.1.8-7.3.mga9
Mageia9noarchx11-server-xwayland< 22.1.9-1.3x11-server-xwayland-22.1.9-1.3.mga9
Mageia9noarchtigervnc< 1.13.1-2.3tigervnc-1.13.1-2.3.mga9

OS	Version	Architecture	Package	Version	Filename
Mageia	9	noarch	x11-server	< 21.1.8-7.3	x11-server-21.1.8-7.3.mga9
Mageia	9	noarch	x11-server-xwayland	< 22.1.9-1.3	x11-server-xwayland-22.1.9-1.3.mga9
Mageia	9	noarch	tigervnc	< 1.13.1-2.3	tigervnc-1.13.1-2.3.mga9