[slackware-security] xorg-server

New xorg-server packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/xorg-server-1.20.14-i586-7slack15.0.txz: Rebuilt. PATCH Xi: fix potential use-after-free in DeepCopyPointerClasses. Also merged...

USN-5846-1: X.Org X Server vulnerability

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled certain memory operations. An attacker could possibly use these issues to cause the X Server to crash, execute arbitrary code, or escalate privileges...

USN-5846-1 xorg-server, xorg-server-hwe-18.04, xwayland vulnerability

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled certain memory operations. An attacker could possibly use these issues to cause the X Server to crash, execute arbitrary code, or escalate privileges...

[SECURITY] [DSA 5342-1] xorg-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5342-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 07, 2023 https://www.debian.org/security/faq -...

xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation

A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo and ProcXkbGetDeviceInfo to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs...

xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation

A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo and ProcXkbGetDeviceInfo to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs...

[SECURITY] [DLA 3310-1] xorg-server security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3310-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz February 07, 2023 https://wiki.debian.org/LTS -...

DSA-5342-1 xorg-server - security update

Bulletin has no description...

Debian DSA-5342-1 : xorg-server - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5342 advisory. - xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation CVE-2023-0494 Note that Nessus has not tested for this issue but has instead relied...

DLA-3310-1 xorg-server - security update

Bulletin has no description...

Slackware Linux 15.0 / current xorg-server Vulnerability (SSA:2023-038-02)

The version of xorg-server installed on the remote host is prior to 1.20.14 / 21.1.4 / 21.1.7 / 22.1.8. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-038-02 advisory. - xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation CVE-2023-0494...

FreeBSD : xorg-server -- Multiple security issues in X server extensions (9fa7b139-c1e9-409e-bed0-006aadcf5845)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 9fa7b139-c1e9-409e-bed0-006aadcf5845 advisory. - A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames...

xorg-x11-server: XvdiSelectVideoNotify use-after-free

A vulnerability was found in X.Org. This flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This flaw can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding...

xorg-x11-server: XTestSwapFakeInput stack overflow

A vulnerability was found in X.Org. The issue occurs due to the swap handler for the XTestFakeInput request of the XTest extension, possibly corrupting the stack if GenericEvents with lengths larger than 32 bytes are sent through the XTestFakeInput request. This flaw can lead to local privilege...

xorg-x11-server: XvdiSelectVideoNotify use-after-free

A vulnerability was found in X.Org. This flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This flaw can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding...

Debian: Security Advisory (DLA-3256-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 3256-1] xorg-server security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3256-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz December 31, 2022 https://wiki.debian.org/LTS -...

DLA-3256-1 xorg-server - security update

Bulletin has no description...

Privilege Escalation

xorg-server, edge is vulnerable to privilege escalation. The vulnerability exists because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed...

Remote Code Execution (RCE)

xorg-server is vulnerable to remote code execution. The vulnerability exists because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code...