Headline

Red Hat Security Advisory 2022-8491-01

Red Hat Security Advisory 2022-8491-01 - X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Issues addressed include buffer overflow and memory leak vulnerabilities.

2 years ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #php #buffer_overflow

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: xorg-x11-server security update
Advisory ID: RHSA-2022:8491-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:8491
Issue date: 2022-11-16
CVE Names: CVE-2022-3550 CVE-2022-3551
====================================================================

Summary:

An update for xorg-x11-server is now available for Red Hat Enterprise Linux

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat Enterprise Linux Client (v. 7) - x86_64
Red Hat Enterprise Linux Client Optional (v. 7) - noarch, x86_64
Red Hat Enterprise Linux ComputeNode Optional (v. 7) - noarch, x86_64
Red Hat Enterprise Linux Server (v. 7) - ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 7) - noarch, ppc64, ppc64le, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 7) - x86_64
Red Hat Enterprise Linux Workstation Optional (v. 7) - noarch, x86_64

Description:

X.Org is an open-source implementation of the X Window System. It provides
the basic low-level functionality that full-fledged graphical user
interfaces are designed upon.

Security Fix(es):

xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c
(CVE-2022-3550)
xorg-x11-server: memory leak in ProcXkbGetKbdByName() in xkb/xkb.c
(CVE-2022-3551)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

Bugs fixed (https://bugzilla.redhat.com/):

2140698 - CVE-2022-3550 xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c
2140701 - CVE-2022-3551 xorg-x11-server: memory leak in ProcXkbGetKbdByName() in xkb/xkb.c

Package List:

Red Hat Enterprise Linux Client (v. 7):

Source:
xorg-x11-server-1.20.4-19.el7_9.src.rpm

x86_64:
xorg-x11-server-Xephyr-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-Xorg-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-common-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.x86_64.rpm

Red Hat Enterprise Linux Client Optional (v. 7):

noarch:
xorg-x11-server-source-1.20.4-19.el7_9.noarch.rpm

x86_64:
xorg-x11-server-Xdmx-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-Xnest-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-Xvfb-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-Xwayland-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.i686.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-devel-1.20.4-19.el7_9.i686.rpm
xorg-x11-server-devel-1.20.4-19.el7_9.x86_64.rpm

Red Hat Enterprise Linux ComputeNode Optional (v. 7):

Source:
xorg-x11-server-1.20.4-19.el7_9.src.rpm

noarch:
xorg-x11-server-source-1.20.4-19.el7_9.noarch.rpm

x86_64:
xorg-x11-server-Xdmx-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-Xephyr-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-Xnest-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-Xorg-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-Xvfb-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-Xwayland-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-common-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.i686.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.x86_64.rpm
xorg-x11-server-devel-1.20.4-19.el7_9.i686.rpm
xorg-x11-server-devel-1.20.4-19.el7_9.x86_64.rpm

Red Hat Enterprise Linux Server (v. 7):

Source:
xorg-x11-server-1.20.4-19.el7_9.src.rpm

ppc64:
xorg-x11-server-Xephyr-1.20.4-19.el7_9.ppc64.rpm
xorg-x11-server-Xorg-1.20.4-19.el7_9.ppc64.rpm
xorg-x11-server-common-1.20.4-19.el7_9.ppc64.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.ppc64.rpm

ppc64le:
xorg-x11-server-Xephyr-1.20.4-19.el7_9.ppc64le.rpm
xorg-x11-server-Xorg-1.20.4-19.el7_9.ppc64le.rpm
xorg-x11-server-common-1.20.4-19.el7_9.ppc64le.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.ppc64le.rpm

s390x:
xorg-x11-server-Xephyr-1.20.4-19.el7_9.s390x.rpm
xorg-x11-server-common-1.20.4-19.el7_9.s390x.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.s390x.rpm

Red Hat Enterprise Linux Server Optional (v. 7):

noarch:
xorg-x11-server-source-1.20.4-19.el7_9.noarch.rpm

ppc64:
xorg-x11-server-Xdmx-1.20.4-19.el7_9.ppc64.rpm
xorg-x11-server-Xnest-1.20.4-19.el7_9.ppc64.rpm
xorg-x11-server-Xvfb-1.20.4-19.el7_9.ppc64.rpm
xorg-x11-server-Xwayland-1.20.4-19.el7_9.ppc64.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.ppc.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.ppc64.rpm
xorg-x11-server-devel-1.20.4-19.el7_9.ppc.rpm
xorg-x11-server-devel-1.20.4-19.el7_9.ppc64.rpm

ppc64le:
xorg-x11-server-Xdmx-1.20.4-19.el7_9.ppc64le.rpm
xorg-x11-server-Xnest-1.20.4-19.el7_9.ppc64le.rpm
xorg-x11-server-Xvfb-1.20.4-19.el7_9.ppc64le.rpm
xorg-x11-server-Xwayland-1.20.4-19.el7_9.ppc64le.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.ppc64le.rpm
xorg-x11-server-devel-1.20.4-19.el7_9.ppc64le.rpm

s390x:
xorg-x11-server-Xdmx-1.20.4-19.el7_9.s390x.rpm
xorg-x11-server-Xnest-1.20.4-19.el7_9.s390x.rpm
xorg-x11-server-Xvfb-1.20.4-19.el7_9.s390x.rpm
xorg-x11-server-Xwayland-1.20.4-19.el7_9.s390x.rpm
xorg-x11-server-debuginfo-1.20.4-19.el7_9.s390x.rpm

Red Hat Enterprise Linux Workstation (v. 7):

Source:
xorg-x11-server-1.20.4-19.el7_9.src.rpm

Red Hat Enterprise Linux Workstation Optional (v. 7):

noarch:
xorg-x11-server-source-1.20.4-19.el7_9.noarch.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2022-3550
https://access.redhat.com/security/cve/CVE-2022-3551
https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBY3TdztzjgjWX9erEAQh7EQ//e2uR00MH8rSXUcWWCH5uXJiuMY9TDdpG
O+7zT+8hTue1bxulTSoGm3H+sgFg0QtGCWzwc5/mXkJyKIVWFiMP+IqmoX53Cl3g
E/Iay8Q3iubcCgR2HAPD4vu4ZzzeIBVUe0RHoTdhiqs2Au8raKdoWsU1ZeE65lD9
mc/GNwzugMyyqKDCRbxh4GpqwYU/P9bQEBaVZq8Jz8eRc6UdGPmd7V+P9E7VuyGd
AERmfuKUb70tdSToAWUKBNjQnfgPHP3fC10xFEqm9nhyswxrQEH+eYF2rkp0TfyT
y9C/KF98hiiNy46i9pS8QV/tkAVaDwOgFcZ1GnOk+AsfWCrqbmU/9HzEznmY5An7
v4v+ObIRiJMJdEiDMtT1oCKWPWmIdGF57I1a/xnDHT6441gmsOX/ZzcBnBChoUvZ
37aw70WN6sWZUFWWX+QJTGOqiWlbExbak9MiNRZ6bAYwt537o7Y6yDra7+K3YB/A
P3whL4wsG5Rge/XjVv110kijTGpj3v5wOYmVbsy80a/d/vvBJGQ/UJb1fEA8Hwdc
u9NudLg5aKOEbADe/EGRWPNm7JGG2x/st23XfMZQjNR6I1oitHNTaVee+8bJHiV+
kf71vnnq9wDVm3fvK0fEW4MtJCSl3VWtxJXSgCrCAtJ0vtSBD4ZRl0RUipT2XuNL
LMV4KibkhLM=h54m
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

An update for xorg-x11-server-Xwayland is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3550: A flaw was found in the xorg-x11-server package. A buffer overflow can occur in the _GetCountedString function in xkb/xkb.c due to improper input validation, allowing for possible escalation of privileges, execution of arbitrary code, or a denial of service. * CVE-2022-3551: A flaw was found in the xorg-x11-server package. The Pro...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #dos #nodejs #js #java #kubernetes #rce #aws #buffer_overflow #ssh #ibm

RHSA-2023:2806: Red Hat Security Advisory: xorg-x11-server security and bug fix update

An update for xorg-x11-server is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3550: A flaw was found in the xorg-x11-server package. A buffer overflow can occur in the _GetCountedString function in xkb/xkb.c due to improper input validation, allowing for possible escalation of privileges, execution of arbitrary code, or a denial of service. * CVE-2022-3551: A flaw was found in the xorg-x11-server package. The ProcXkbGetKb...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #dos #rce #buffer_overflow #ssh #ibm

RHSA-2023:2249: Red Hat Security Advisory: xorg-x11-server-Xwayland security update

An update for xorg-x11-server-Xwayland is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3550: A flaw was found in the xorg-x11-server package. A buffer overflow can occur in the _GetCountedString function in xkb/xkb.c due to improper input validation, allowing for possible escalation of privileges, execution of arbitrary code, or a denial of service. * CVE-2022-3551: A flaw was found in the xorg-x11-server package. The Pro...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #dos #nodejs #js #java #kubernetes #rce #aws #buffer_overflow #ssh #ibm

RHSA-2023:2248: Red Hat Security Advisory: xorg-x11-server security and bug fix update

An update for xorg-x11-server is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3550: A flaw was found in the xorg-x11-server package. A buffer overflow can occur in the _GetCountedString function in xkb/xkb.c due to improper input validation, allowing for possible escalation of privileges, execution of arbitrary code, or a denial of service. * CVE-2022-3551: A flaw was found in the xorg-x11-server package. The ProcXkbGetKb...

1 year ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #dos #rce #buffer_overflow #ssh #ibm

Ubuntu Security Notice USN-5740-1

Ubuntu Security Notice 5740-1 - It was discovered that X.Org X Server incorrectly handled certain inputs. An attacker could use these issues to cause the server to crash, resulting in a denial of service, or possibly execute arbitrary code.

2 years ago

Packet Storm

Open in Source

#vulnerability #ubuntu #dos

RHSA-2022:8491: Red Hat Security Advisory: xorg-x11-server security update

An update for xorg-x11-server is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-3550: xorg-x11-server: buffer overflow in _GetCountedString() in xkb/xkb.c * CVE-2022-3551: xorg-x11-server: memory leak in ProcXkbGetKbdByName() in xkb/xkb.c

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #buffer_overflow #ibm

RHSA-2022:8491: Red Hat Security Advisory: xorg-x11-server security update

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #buffer_overflow #ibm

Debian Security Advisory 5278-1

Debian Linux Security Advisory 5278-1 - It was discovered that a buffer overflow in the _getCountedString() function of the Xorg X server may result in denial of service or potentially the execution of arbitrary code.

2 years ago

Packet Storm

Open in Source

#mac #linux #debian #dos #buffer_overflow

Debian Security Advisory 5278-1

2 years ago

Packet Storm

Open in Source

#mac #linux #debian #dos #buffer_overflow

CVE-2022-3550

A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051.

2 years ago

CVE

Open in Source

#vulnerability #buffer_overflow

CVE-2022-3551

A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052.

2 years ago

CVE

Open in Source

#vulnerability