Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-5574: A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
Fixed packages 10
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | xorg-x11-server-common | 0:1.20.4-22.amzn2.0.2 |
| Amazon Linux · 2 | xorg-x11-server-debuginfo | 0:1.20.4-22.amzn2.0.2 |
| Amazon Linux · 2 | xorg-x11-server-devel | 0:1.20.4-22.amzn2.0.2 |
| Amazon Linux · 2 | xorg-x11-server-source | 0:1.20.4-22.amzn2.0.2 |
| Amazon Linux · 2 | xorg-x11-server-Xdmx | 0:1.20.4-22.amzn2.0.2 |
| Amazon Linux · 2 | xorg-x11-server-Xephyr | 0:1.20.4-22.amzn2.0.2 |
| Amazon Linux · 2 | xorg-x11-server-Xnest | 0:1.20.4-22.amzn2.0.2 |
| Amazon Linux · 2 | xorg-x11-server-Xorg | 0:1.20.4-22.amzn2.0.2 |
| Amazon Linux · 2 | xorg-x11-server-Xvfb | 0:1.20.4-22.amzn2.0.2 |
| Amazon Linux · 2 | xorg-x11-server-Xwayland | 0:1.20.4-22.amzn2.0.2 |
Vulnerabilities 1
-
High 7.0
Xorg-x11-server: use-after-free bug in damagedestroy
A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a sc…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-5574.html