Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-5380: A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed. CVE-2023-5367: A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | xorg-x11-server-common | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-debuginfo | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-debugsource | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-devel | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-source | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-Xdmx | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-Xdmx-debuginfo | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-Xephyr | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-Xephyr-debuginfo | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-Xnest | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-Xnest-debuginfo | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-Xorg | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-Xorg-debuginfo | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-Xvfb | 0:1.20.14-26.amzn2023.0.1 |
| Amazon Linux · 2023 | xorg-x11-server-Xvfb-debuginfo | 0:1.20.14-26.amzn2023.0.1 |
Vulnerabilities 2
-
High 7.8
Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty
A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty func…
-
Medium 4.7
Xorg-x11-server: use-after-free bug in destroywindow
A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on o…