Skip to content
OpenAdvisories
High ALAS2-2023-1910 2 CVEs

Important: xorg-x11-server security update (Amazon Linux 2)

Published Jan 18, 2023 · Updated Jan 20, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-3551: A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052. CVE-2022-3550: A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 xorg-x11-server-common 0:1.20.4-19.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-debuginfo 0:1.20.4-19.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-devel 0:1.20.4-19.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-source 0:1.20.4-19.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xdmx 0:1.20.4-19.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xephyr 0:1.20.4-19.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xnest 0:1.20.4-19.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xorg 0:1.20.4-19.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xvfb 0:1.20.4-19.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xwayland 0:1.20.4-19.amzn2.0.1

Vulnerabilities 2

  • Medium 5.5
    CVE-2022-3550

    X.org Server xkb.c _GetCountedString buffer overflow

    A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The asso…

    X.Org Server xorg-server xorg-server Debian Ubuntu Azure Linux
  • Low 3.5
    CVE-2022-3551

    X.org Server xkb.c ProcXkbGetKbdByName memory leak

    A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue…

    X.Org Server xorg-server xorg-server Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-3550.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-3551.html