Most recent entries from all

ALSA-2022:7583 — Moderate: xorg-x11-server and xorg-x11-server-Xwayland security and bug fix update

Affected: AlmaLinux:8: xorg-x11-server-Xdmx, AlmaLinux:8: xorg-x11-server-Xephyr, AlmaLinux:8: xorg-x11-server-Xnest, AlmaLinux:8: xorg-x11-server-Xorg, AlmaLinux:8: xorg-x11-server-Xvfb, AlmaLinux:8: xorg-x11-server-Xwayland, AlmaLinux:8: xorg-x11-server-common, AlmaLinux:8: xorg-x11-server-devel, AlmaLinux:8: xorg-x11-server-source

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access (CVE-2022-2319) * xorg-x11-server: out-of-bounds access in ProcXkbSetDeviceInfo request handler of the Xkb extension (CVE-2022-2320)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2022-04749

Withdrawn: BELL-CVE-2022-2320 — CVE-2022-2320 does not affect BellSoft software

Withdrawn by the publisher.

EUVD-2026-12303

fkie_cve-2022-2320

A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker to escalate privileges and execute arbitrary code in the context of root.

GHSA-w5qv-457x-4w67

gsd-2022-2320

OESA-2022-1834 — xorg-x11-server security update

Affected: openEuler:20.03-LTS-SP1: xorg-x11-server, openEuler:20.03-LTS-SP3: xorg-x11-server, openEuler:22.03-LTS: xorg-x11-server

X.Org X11 X server Security Fix(es): CVE-2022-2320/ZDI-CAN-16070: xorg-x11-server: out-of-bounds write in ProcXkbSetDeviceInfo request handler of the Xkb extension Introduced In: https://github.com/freedesktop/xorg-xserver/commit/c06e27b2f6fd9f7b9f827623a48876a225264132 Fixed In: https://github.com/freedesktop/xorg-xserver/commit/dd8caf39e9e15d8f302e54045dd08d8ebf1025dc(CVE-2022-2320) CVE-2022-2319/ZDI-CAN-16062: X.Org Server ProcXkbSetGeometry Out-Of-Bounds Access https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/938 https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/939(CVE-2022-2319)

openSUSE-SU-2024:12187-1 — xorg-x11-server-21.1.3-8.1 on GA media

xorg-x11-server-21.1.3-8.1 on GA media

SUSE-SU-2022:2369-1 — Security update for xorg-x11-server

Security update for xorg-x11-server

UBUNTU-CVE-2022-2320

Affected: Ubuntu:Pro:14.04:LTS: xorg-server, Ubuntu:Pro:16.04:LTS: xorg-server, Ubuntu:Pro:16.04:LTS: xorg-server-hwe-16.04, Ubuntu:18.04:LTS: xorg-server, Ubuntu:18.04:LTS: xorg-server-hwe-18.04, Ubuntu:20.04:LTS: xorg-server, Ubuntu:22.04:LTS: xorg-server, Ubuntu:22.04:LTS: xwayland

VDE-2022-049 — TRUMPF: Multiple products prone to X.Org server vulnerabilities

TruControl laser control software from versions 1.60.0 to 3.40.0 use a vulnerable X.Org server versions. The affected X.Org vulnerability is not validating the request length properly for the handler 'ProcXkbSetGeometry'. An authenticated Attacker could craft a request which could lead to memory out-of bounds write.

WID-SEC-W-2022-0661 — X.Org X11: Mehrere Schwachstellen

Ein lokaler Angreifer kann mehrere Schwachstellen in X.Org X11 ausnutzen, um seine Privilegien zu erhöhen oder beliebigen Programmcode mit Administratorrechten auszuführen.