{"id":112973,"date":"2024-01-18T11:28:03","date_gmt":"2024-01-18T09:28:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-11-s-ustraneniem-6-uyazvimostej"},"modified":"2024-01-18T11:28:03","modified_gmt":"2024-01-18T09:28:03","slug":"obnovlenie-x-org-server-21-1-11-s-ustraneniem-6-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/obnovlenie-x-org-server-21-1-11-s-ustraneniem-6-uyazvimostej","title":{"rendered":"Aktualizace X.Org Server 21.1.11 s odstran\u011bn\u00edm 6 zranitelnost\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Byly vyd\u00e1ny opravn\u00e9 verze X.Org Server 21.1.11 a DDX komponenty (Device-Dependent X) xwayland 23.2.4, kter\u00e1 umo\u017e\u0148uje spu\u0161t\u011bn\u00ed X.Org Serveru pro b\u011bh X11 aplikac\u00ed v prost\u0159ed\u00edch zalo\u017een\u00fdch na Waylandu. V nov\u00fdch verz\u00edch bylo odstran\u011bno 6 zranitelnost\u00ed, z nich\u017e n\u011bkter\u00e9 mohou b\u00fdt zneu\u017eity k zv\u00fd\u0161en\u00ed opr\u00e1vn\u011bn\u00ed v syst\u00e9mech, kde X server b\u011b\u017e\u00ed s opr\u00e1vn\u011bn\u00edmi root, a tak\u00e9 pro vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du v konfigurac\u00edch, kde je p\u0159\u00edstup povolen skrze p\u0159esm\u011brov\u00e1n\u00ed X11 sezen\u00ed pomoc\u00ed SSH.     <\/p>\n<p>Identifikovan\u00e9 probl\u00e9my:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-6816 \u2014 p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku, kter\u00e9 nast\u00e1v\u00e1 p\u0159i p\u0159ed\u00e1v\u00e1n\u00ed nespr\u00e1vn\u00e9ho indexu pole v operac\u00edch DeviceFocusEvent a ProcXIQueryPointer. Zranitelnost je zp\u016fsobena t\u00edm, \u017ee X-server alokuje pam\u011b\u0165 pole s ohledem na skute\u010dn\u00fd po\u010det tla\u010d\u00edtek, zat\u00edmco dotaz umo\u017e\u0148uje pou\u017e\u00edvat v poli hodnoty a\u017e do 255. Probl\u00e9m se objevuje od vyd\u00e1n\u00ed xorg-server-1.13.0 (rok 2012).\n<li class=\"l\"> CVE-2024-0229 \u2014 z\u00e1pis do oblasti mimo hranice z\u00e1sobn\u00edku prost\u0159ednictv\u00edm op\u011btovn\u00e9ho p\u0159ipojen\u00ed k jin\u00e9mu master za\u0159\u00edzen\u00ed v konfiguraci, kde je za\u0159\u00edzen\u00ed sou\u010dasn\u011b vybaveno prvky vstupu t\u0159\u00eddy \u201etla\u010d\u00edtko\u201c (button) a \u201ekl\u00e1vesa\u201c (key), a p\u0159i\u010dem\u017e po\u010det tla\u010d\u00edtek (parametr numButtons) je nastaven na 0. Probl\u00e9m se objevuje od vyd\u00e1n\u00ed xorg-server-1.1.1 (rok 2006).\n<li class=\"l\"> CVE-2024-21885 \u2014 p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku ve funkci XISendDeviceHierarchyEvent, kter\u00e9 nast\u00e1v\u00e1 p\u0159i odstran\u011bn\u00ed za\u0159\u00edzen\u00ed se zadan\u00fdm identifik\u00e1torem a p\u0159id\u00e1n\u00ed za\u0159\u00edzen\u00ed se stejn\u00fdm identifik\u00e1torem v r\u00e1mci jednoho po\u017eadavku. Zranitelnost je zp\u016fsobena t\u00edm, \u017ee p\u0159i dvoj\u00ed operaci pro jeden identifik\u00e1tor se zapisuj\u00ed hned dva exempl\u00e1\u0159e struktury xXIHierarchyInfo, zat\u00edmco funkce XISendDeviceHierarchyEvent alokuje pam\u011b\u0165 s v\u00fdpo\u010dtem na jeden exempl\u00e1\u0159. Probl\u00e9m se objevuje od vyd\u00e1n\u00ed xorg-server-1.10.0 (rok 2010).\n<li class=\"l\"> CVE-2024-21886 \u2014 p\u0159ete\u010den\u00ed z\u00e1sobn\u00edku ve funkci DisableDevice, kter\u00e9 nast\u00e1v\u00e1 p\u0159i odpojen\u00ed master za\u0159\u00edzen\u00ed p\u0159i ji\u017e odpojen\u00fdch slave za\u0159\u00edzen\u00edch. Zranitelnost je zp\u016fsobena nespr\u00e1vn\u00fdm v\u00fdpo\u010dtem velikosti struktury pro uchov\u00e1n\u00ed seznamu za\u0159\u00edzen\u00ed. Probl\u00e9m se objevuje od vyd\u00e1n\u00ed xorg-server-1.13.0 (rok 2012).\n<li class=\"l\">  CVE-2024-0409, CVE-2024-0408 \u2014 po\u0161kozen\u00ed kontextu SELinux p\u0159i aktivaci xserver_object_manager a spu\u0161t\u011bn\u00ed klienta nebo vytvo\u0159en\u00ed GLX PBuffer.         <\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=60456\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.11 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 23.2.4, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 Wayland. \u0412 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043e 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 X-\u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-112973","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.11 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 23.2.4, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/news\/obnovlenie-x-org-server-21-1-11-s-ustraneniem-6-uyazvimostej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 X.Org Server 21.1.11 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.11 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 23.2.4, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/news\/obnovlenie-x-org-server-21-1-11-s-ustraneniem-6-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-01-18T09:28:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-01-18T09:28:03+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Aktualizace X.Org Serveru 21.1.11 s opravou 6 zranitelnost\u00ed | ProHoster","description":"Byly vyd\u00e1ny opravy pro X.Org Server 21.1.11 a DDX komponentu (Device-Dependent X) xwayland 23.2.4, kter\u00fd umo\u017e\u0148uje spu\u0161t\u011bn\u00ed X.Org Serveru pro b\u011bh X11 aplikac\u00ed v prost\u0159ed\u00edch zalo\u017een\u00fdch na.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/obnovlenie-x-org-server-21-1-11-s-ustraneniem-6-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 X.Org Server 21.1.11 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c 6 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.11 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 23.2.4, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/obnovlenie-x-org-server-21-1-11-s-ustraneniem-6-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2024-01-18T09:28:03+00:00","article:modified_time":"2024-01-18T09:28:03+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/112973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=112973"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/112973\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=112973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=112973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=112973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}