[SECURITY] [DLA 3310-1] xorg-server security update

2023-02-0707:27:41

lists.debian.org

xorg server

debian 10 buster

privilege escalation

remote code execution

cve-2023-0494

security update

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

51.9%

JSON

Debian LTS Advisory DLA-3310-1 [email protected]
https://www.debian.org/lts/security/ Thorsten Alteholz
February 07, 2023 https://wiki.debian.org/LTS

Package : xorg-server
Version : 2:1.20.4-1+deb10u8
CVE ID : CVE-2023-0494

Jan-Niklas Sohn, working with Trend Micro Zero Day Initiative, discovered
a vulnerability in the X.Org X server.
A potential use after free mighty result in local privilege escalation if
the X server is running privileged or remote code execution during ssh X
forwarding sessions.

For Debian 10 buster, this problem has been fixed in version
2:1.20.4-1+deb10u8.

We recommend that you upgrade your xorg-server packages.

For the detailed security status of xorg-server please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/xorg-server

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian11ppc64elxserver-xorg-core< 2:1.20.11-1+deb11u5xserver-xorg-core_2:1.20.11-1+deb11u5_ppc64el.deb
Debian11arm64xserver-xephyr-dbgsym< 2:1.20.11-1+deb11u5xserver-xephyr-dbgsym_2:1.20.11-1+deb11u5_arm64.deb
Debian11armhfxserver-xorg-legacy-dbgsym< 2:1.20.11-1+deb11u5xserver-xorg-legacy-dbgsym_2:1.20.11-1+deb11u5_armhf.deb
Debian11armhfxwayland-dbgsym< 2:1.20.11-1+deb11u5xwayland-dbgsym_2:1.20.11-1+deb11u5_armhf.deb
Debian10arm64xvfb< 2:1.20.4-1+deb10u8xvfb_2:1.20.4-1+deb10u8_arm64.deb
Debian11amd64xdmx-dbgsym< 2:1.20.11-1+deb11u5xdmx-dbgsym_2:1.20.11-1+deb11u5_amd64.deb
Debian11arm64xdmx< 2:1.20.11-1+deb11u5xdmx_2:1.20.11-1+deb11u5_arm64.deb
Debian11ppc64elxwayland-dbgsym< 2:1.20.11-1+deb11u5xwayland-dbgsym_2:1.20.11-1+deb11u5_ppc64el.deb
Debian11armhfxnest-dbgsym< 2:1.20.11-1+deb11u5xnest-dbgsym_2:1.20.11-1+deb11u5_armhf.deb
Debian11mipselxnest< 2:1.20.11-1+deb11u5xnest_2:1.20.11-1+deb11u5_mipsel.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	ppc64el	xserver-xorg-core	< 2:1.20.11-1+deb11u5	xserver-xorg-core_2:1.20.11-1+deb11u5_ppc64el.deb
Debian	11	arm64	xserver-xephyr-dbgsym	< 2:1.20.11-1+deb11u5	xserver-xephyr-dbgsym_2:1.20.11-1+deb11u5_arm64.deb
Debian	11	armhf	xserver-xorg-legacy-dbgsym	< 2:1.20.11-1+deb11u5	xserver-xorg-legacy-dbgsym_2:1.20.11-1+deb11u5_armhf.deb
Debian	11	armhf	xwayland-dbgsym	< 2:1.20.11-1+deb11u5	xwayland-dbgsym_2:1.20.11-1+deb11u5_armhf.deb
Debian	10	arm64	xvfb	< 2:1.20.4-1+deb10u8	xvfb_2:1.20.4-1+deb10u8_arm64.deb
Debian	11	amd64	xdmx-dbgsym	< 2:1.20.11-1+deb11u5	xdmx-dbgsym_2:1.20.11-1+deb11u5_amd64.deb
Debian	11	arm64	xdmx	< 2:1.20.11-1+deb11u5	xdmx_2:1.20.11-1+deb11u5_arm64.deb
Debian	11	ppc64el	xwayland-dbgsym	< 2:1.20.11-1+deb11u5	xwayland-dbgsym_2:1.20.11-1+deb11u5_ppc64el.deb
Debian	11	armhf	xnest-dbgsym	< 2:1.20.11-1+deb11u5	xnest-dbgsym_2:1.20.11-1+deb11u5_armhf.deb
Debian	11	mipsel	xnest	< 2:1.20.11-1+deb11u5	xnest_2:1.20.11-1+deb11u5_mipsel.deb