Advisory ROSA-SA-2024-2324

2024-01-2312:14:57

ROSA LAB

abf.rosalinux.ru

xorg-x11-server

rosa-sa-2024-2324

rosa-server79

memory overruns

privilege escalation

remote code execution

integer overflow

sensitive information disclosure

yum update

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

0.273 Low

EPSS

Percentile

96.8%

JSON

Software: xorg-x11-server 1.20.4
OS: rosa-server79

package_evr_string: xorg-x11-server-1.20.4-25.res7

CVE-ID: CVE-2023-6377
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC.: An error has been detected in xorg-server. Requesting or modifying XKB button actions, such as switching from touchpad to mouse, can result in read and write memory overruns. This could allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.
CVE-STATUS: Fixed
CVE-REV: Run the yum update xorg-x11-server command to close.

CVE-ID: CVE-2023-6478
BDU-ID: None
CVE-Crit: HIGH
CVE-DESC.: An error was detected in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty could cause an integer overflow that could result in the disclosure of sensitive information.
CVE-STATUS: Fixed
CVE-REV: To close, run the yum update xorg-x11-server command