Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2023-0494: A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | tigervnc | 0:1.8.0-24.amzn2.0.2 |
| Amazon Linux · 2 | tigervnc-debuginfo | 0:1.8.0-24.amzn2.0.2 |
| Amazon Linux · 2 | tigervnc-icons | 0:1.8.0-24.amzn2.0.2 |
| Amazon Linux · 2 | tigervnc-license | 0:1.8.0-24.amzn2.0.2 |
| Amazon Linux · 2 | tigervnc-server | 0:1.8.0-24.amzn2.0.2 |
| Amazon Linux · 2 | tigervnc-server-applet | 0:1.8.0-24.amzn2.0.2 |
| Amazon Linux · 2 | tigervnc-server-minimal | 0:1.8.0-24.amzn2.0.2 |
| Amazon Linux · 2 | tigervnc-server-module | 0:1.8.0-24.amzn2.0.2 |
Vulnerabilities 1
-
High 7.8
A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be e…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-0494.html