Debian Security Bug TrackerDEBIANCVE:CVE-2022-46340CVE-2022-46340
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.025 Low
EPSS
Percentile
90.3%
A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Debian | 12 | all | xorg-server | < 2:21.1.5-1 | xorg-server_2:21.1.5-1_all.deb |
| Debian | 11 | all | xorg-server | < 2:1.20.11-1+deb11u4 | xorg-server_2:1.20.11-1+deb11u4_all.deb |
| Debian | 999 | all | xorg-server | < 2:21.1.5-1 | xorg-server_2:21.1.5-1_all.deb |
| Debian | 13 | all | xorg-server | < 2:21.1.5-1 | xorg-server_2:21.1.5-1_all.deb |
| Debian | 12 | all | xwayland | < 2:22.1.6-1 | xwayland_2:22.1.6-1_all.deb |
| Debian | 999 | all | xwayland | < 2:22.1.6-1 | xwayland_2:22.1.6-1_all.deb |
| Debian | 13 | all | xwayland | < 2:22.1.6-1 | xwayland_2:22.1.6-1_all.deb |
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.025 Low
EPSS
Percentile
90.3%