CVE-2022-2319
published 2022-09-01CVE-2022-2319: A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request…
PriorityP341high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.44%
36.1th percentile
A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xorg-server | < xorg-server 2:21.1.4-1 (bookworm) | xorg-server 2:21.1.4-1 (bookworm) |
| debian | xwayland | < xorg-server 2:21.1.4-1 (bookworm) | xorg-server 2:21.1.4-1 (bookworm) |
| x.org | x_server | — | — |
| x.org | xorg-server | >= 0 < 2:1.20.11-1+deb11u2 | 2:1.20.11-1+deb11u2 |
| x.org | xorg-server | >= 0 < 2:21.1.4-1 | 2:21.1.4-1 |
| x.org | xorg-server | >= 0 < 2:21.1.4-1 | 2:21.1.4-1 |
| x.org | xorg-server | >= 0 < 2:21.1.4-1 | 2:21.1.4-1 |
| x.org | xwayland | >= 0 < 2:22.1.3-1 | 2:22.1.3-1 |
| x.org | xwayland | >= 0 < 2:22.1.3-1 | 2:22.1.3-1 |
| x.org | xwayland | >= 0 < 2:22.1.3-1 | 2:22.1.3-1 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gq7h-9qq6-mccc: A flaw was found in the Xorg-x11-server
ghsa_unreviewed·2022-09-02
CVE-2022-2319 [HIGH] CWE-1320 GHSA-gq7h-9qq6-mccc: A flaw was found in the Xorg-x11-server
A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length.
OSV
CVE-2022-2319: A flaw was found in the Xorg-x11-server
osv·2022-09-01·CVSS 7.8
CVE-2022-2319 [HIGH] CVE-2022-2319: A flaw was found in the Xorg-x11-server
A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length.
Red Hat
xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access
vendor_redhat·2022-07-13·CVSS 7.8
CVE-2022-2319 [HIGH] CWE-1320 xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access
xorg-x11-server: X.Org Server ProcXkbSetGeometry out-of-bounds access
A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length.
A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length.
Statement: Xorg server does not run with root privileges in Red Hat Enterprise Linux 8, therefore this flaw has been rated as having Moderate impact.
Package: xorg-x11-server (Red Hat Enterprise Linux 6) - Out of support scope
Ubuntu
X.Org X Server vulnerabilities
vendor_ubuntu·2022-07-12
CVE-2022-2319 X.Org X Server vulnerabilities
Title: X.Org X Server vulnerabilities
Summary: Several security issues were fixed in X.Org X Server.
USN-5510-1 fixed several vulnerabilities in X.Org. This update provides
the corresponding update for Ubuntu 16.04 ESM.
Original advisory details:
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
certain inputs. An attacker could use this issue to cause the server to
crash, resulting in a denial of service, or possibly execute arbitrary
code and escalate privileges.
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
Ubuntu
X.Org X Server vulnerabilities
vendor_ubuntu·2022-07-12
CVE-2022-2320 X.Org X Server vulnerabilities
Title: X.Org X Server vulnerabilities
Summary: Several security issues were fixed in X.Org X Server.
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
certain inputs. An attacker could use this issue to cause the server to
crash, resulting in a denial of service, or possibly execute arbitrary
code and escalate privileges.
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
Debian
CVE-2022-2319: xorg-server - A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur...
vendor_debian·2022·CVSS 7.8
CVE-2022-2319 [HIGH] CVE-2022-2319: xorg-server - A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur...
A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length.
Scope: local
bookworm: resolved (fixed in 2:21.1.4-1)
bullseye: resolved (fixed in 2:1.20.11-1+deb11u2)
forky: resolved (fixed in 2:21.1.4-1)
sid: resolved (fixed in 2:21.1.4-1)
trixie: resolved (fixed in 2:21.1.4-1)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/938https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/939https://lists.freedesktop.org/archives/xorg-announce/2022-July/003192.htmlhttps://security.gentoo.org/glsa/202210-30https://security.netapp.com/advisory/ntap-20221104-0003/https://www.zerodayinitiative.com/advisories/ZDI-22-964/https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/938https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/939https://lists.freedesktop.org/archives/xorg-announce/2022-July/003192.htmlhttps://security.gentoo.org/glsa/202210-30https://security.netapp.com/advisory/ntap-20221104-0003/https://www.zerodayinitiative.com/advisories/ZDI-22-964/
2022-09-01
Published