Summary
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
certain memory operations in the X Keyboard Extension. An attacker could
use this issue to cause the X Server to crash, leading to a denial of
service, or possibly execute arbitrary code.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | xorg-server | 2:1.20.13-1ubuntu1~20.04.18 |
| Ubuntu · 22.04 LTS 22.04:LTS | xorg-server | 2:21.1.4-2ubuntu1.7~22.04.12 |
| Ubuntu · 22.04 LTS 22.04:LTS | xwayland | 2:22.1.1-1ubuntu0.14 |
| Ubuntu · 24.04 LTS 24.04:LTS | xorg-server | 2:21.1.12-1ubuntu1.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | xwayland | 2:23.2.6-1ubuntu0.1 |
Vulnerabilities 1
-
High 7.8
Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability
A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalatio…
References
-
report
https://ubuntu.com/security/CVE-2024-9632