Skip to content
OpenAdvisories
High ALAS2-2023-2335 2 CVEs

Important: xorg-x11-server security update (Amazon Linux 2)

Published Nov 9, 2023 · Updated Nov 15, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5380: A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed. CVE-2023-5367: A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 xorg-x11-server-common 0:1.20.4-22.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-debuginfo 0:1.20.4-22.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-devel 0:1.20.4-22.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-source 0:1.20.4-22.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xdmx 0:1.20.4-22.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xephyr 0:1.20.4-22.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xnest 0:1.20.4-22.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xorg 0:1.20.4-22.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xvfb 0:1.20.4-22.amzn2.0.1
Amazon Linux · 2 xorg-x11-server-Xwayland 0:1.20.4-22.amzn2.0.1

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-5367.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-5380.html