Lucene search

K
rosalinuxROSA LABROSA-SA-2023-2154
HistoryApr 18, 2023 - 11:49 a.m.

Advisory ROSA-SA-2023-2154

2023-04-1811:49:06
ROSA LAB
abf.rosalinux.ru
9
advisory
tigervnc
1.8.0
rosa-server79
cve-2023-1393
use-after-free
elevated privileges
xserver
dangling pointer
compscreen
yum update

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0

Percentile

15.9%

Software: tigervnc 1.8.0
OS: rosa-server79

package_evr_string: 1.8.0-25

CVE-ID: CVE-2023-1393
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC: Use-After-Free can result in elevated local privileges. If a client explicitly destroys a linker overlay window (also known as COW), Xserver will leave a dangling pointer to that window in the CompScreen structure, which will later trigger use-after-free.
CVE-STATUS: Fixed
CVE-REV: Run the yum update tigervnc command to close it

OSVersionArchitecturePackageVersionFilename
rosaanynoarchtigervnc< 1.8.0UNKNOWN

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0

Percentile

15.9%