Summary
[1.20.4-24]
- Fix use after free related to CVE-2024-21886
[1.20.11-23]
- CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
CVE-2024-0408 and CVE-2024-0409
Resolves: https://issues.redhat.com/browse/RHEL-21203
Resolves: https://issues.redhat.com/browse/RHEL-20531
Resolves: https://issues.redhat.com/browse/RHEL-20380
Resolves: https://issues.redhat.com/browse/RHEL-20386
Resolves: https://issues.redhat.com/browse/RHEL-21193
Resolves: https://issues.redhat.com/browse/RHEL-21200
[1.20.11-22]
- CVE fix for: CVE-2023-6377, CVE-2023-6478
Resolves: https://issues.redhat.com/browse/RHEL-18322
Resolves: https://issues.redhat.com/browse/RHEL-18329
[1.20.11-20]
- CVE fix for: CVE-2023-5380
Resolves: https://issues.redhat.com/browse/RHEL-14062
[1.20.11-20]
- CVE fix for: CVE-2023-5367
Resolves: https://issues.redhat.com/browse/RHEL-13430
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | xorg-x11-server-common | 0:1.20.11-24.el9 |
| Oracle Linux · 9 | xorg-x11-server-devel | 0:1.20.11-24.el9 |
| Oracle Linux · 9 | xorg-x11-server-source | 0:1.20.11-24.el9 |
| Oracle Linux · 9 | xorg-x11-server-Xdmx | 0:1.20.11-24.el9 |
| Oracle Linux · 9 | xorg-x11-server-Xephyr | 0:1.20.11-24.el9 |
| Oracle Linux · 9 | xorg-x11-server-Xnest | 0:1.20.11-24.el9 |
| Oracle Linux · 9 | xorg-x11-server-Xorg | 0:1.20.11-24.el9 |
| Oracle Linux · 9 | xorg-x11-server-Xvfb | 0:1.20.11-24.el9 |
Vulnerabilities 10
-
Critical 9.8
Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device'…
-
High 7.8
Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty
A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty func…
-
High 7.8
Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions
A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where …
-
High 7.8
Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the serv…
-
High 7.8
Xorg-x11-server: selinux context corruption
A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
-
High 7.8
Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent
A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which ma…
-
High 7.8
Xorg-x11-server: heap buffer overflow in disabledevice
A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments.
-
High 7.6
Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty
A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.
-
Medium 5.5
Xorg-x11-server: selinux unlabeled glx pbuffer
A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource t…
-
Medium 4.7
Xorg-x11-server: use-after-free bug in destroywindow
A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on o…