{"id":112973,"date":"2024-01-18T11:28:03","date_gmt":"2024-01-18T09:28:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-11-s-ustraneniem-6-uyazvimostej"},"modified":"2024-01-18T11:28:03","modified_gmt":"2024-01-18T09:28:03","slug":"obnovlenie-x-org-server-21-1-11-s-ustraneniem-6-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-x-org-server-21-1-11-s-ustraneniem-6-uyazvimostej","title":{"rendered":"Update X.Org Server 21.1.11 addresses 6 vulnerabilities","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases X.Org Server 21.1.11 and the DDX component (Device-Dependent X) xwayland 23.2.4 have been published, enabling the X.Org Server to run X11 applications in Wayland-based environments. The new versions address six vulnerabilities, some of which could be exploited for privilege escalation on systems where the X server runs with root privileges, as well as for remote code execution in configurations using X11 session forwarding via SSH. <\/p>\n
Identified issues: <\/p>\n
\n
CVE-2023-6816 \u2014 a buffer overflow that occurs when an incorrect array index is passed in DeviceFocusEvent and ProcXIQueryPointer operations. The vulnerability arises from the fact that the X server allocates memory for the array based on the actual number of buttons, while the query allows values up to 255 in the array. The issue has been present since the release of xorg-server-1.13.0 (2012).\n
CVE-2024-0229 \u2014 out-of-bounds write through rebinding to another master device in a configuration where the device is simultaneously equipped with input elements of the \u2018button\u2019 and \u2018key\u2019 classes, and the number of buttons (numButtons parameter) is set to 0. The problem has been present since the release of xorg-server-1.1.1 (2006).\n
CVE-2024-21885 \u2014 a buffer overflow in the XISendDeviceHierarchyEvent function, occurring when a device with a specified identifier is removed and a device with the same identifier is added within a single request. The vulnerability arises because the double operation for a single identifier writes two instances of the xXIHierarchyInfo structure, while the XISendDeviceHierarchyEvent function allocates memory for only one instance. The issue has been present since the release of xorg-server-1.10.0 (2010).\n
CVE-2024-21886 \u2014 a buffer overflow in the DisableDevice function, occurring when a master device is disabled while slave devices are already disabled. The vulnerability is caused by an incorrect size calculation for the structure used to hold the list of devices. The issue has been present since the release of xorg-server-1.13.0 (2012).\n
CVE-2024-0409, CVE-2024-0408 \u2014 corruption of the SELinux context when enabling xserver_object_manager and launching a client or creating a GLX PBuffer. <\/ul>\n