CVE-2022-46340

CWE-787 — Out-of-bounds WriteCWE-121 — Stack-based Buffer Overflow10 documents8 sources
Severity
8.8HIGH
EPSS
1.1%
top 21.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Debian Debian LinuxFedoraproject FedoraX.org X Server
Timeline
PublishedDec 14
Latest updateFeb 16

Description

A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte ord…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶Debianxorg-server< 2:1.20.11-1+deb11u4+3
▶NVDx.org/x_server1.20.4
▶CVEListV5xorg-x11-serverxorg-x11-server-1.20.4
▶Debianxwayland< 2:22.1.6-1+2

Also affects: Debian Linux 11.0, Fedora 36, 37

🔴Vulnerability Details

3
GHSA
GHSA-hvwj-m4ph-92v4: A vulnerability was found in X↗2022-12-14
▶
CVEList
CVE-2022-46340: A vulnerability was found in X↗2022-12-14
▶
OSV
CVE-2022-46340: A vulnerability was found in X↗2022-12-14
▶

📋Vendor Advisories

6
Ubuntu
X.Org X Server vulnerabilities↗2023-02-16
▶
Red Hat
xorg-x11-server: XTestSwapFakeInput stack overflow↗2022-12-14
▶
BSD
OpenBSD 7.2 Errata 009: SECURITY FIX↗2022-12-14
▶
Ubuntu
X.Org X Server vulnerabilities↗2022-12-14
▶
BSD
OpenBSD 7.1 Errata 015: SECURITY FIX↗2022-12-14
▶
CVE-2022-46340 (HIGH CVSS 8.8) | A vulnerability was found in X.Org | cvebase.io