Debian Xorg-Server vulnerabilities

CVE-2024-31082 [HIGH] CVE-2024-31082: xorg-server - A heap-based buffer over-read vulnerability was found in the X.org server's Proc... A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an atta

CVE-2024-31083 [HIGH] CVE-2024-31083: xorg-server - A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function o... A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-

CVE-2024-21885 [HIGH] CVE-2024-21885: xorg-server - A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it... A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments. Scope: local

CVE-2024-31080 [HIGH] CVE-2024-31080: xorg-server - A heap-based buffer over-read vulnerability was found in the X.org server's Proc... A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attac

CVE-2024-31081 [HIGH] CVE-2024-31081: xorg-server - A heap-based buffer over-read vulnerability was found in the X.org server's Proc... A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attac

CVE-2024-0409 [HIGH] CVE-2024-0409: xorg-server - A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwaylan... A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context. Scope: local bookworm: resolved (fixed in 2:21.1.7-3+deb12u5) bullseye: resolved (fixed in 2:1.20.11-1+deb11u11)

CVE-2024-0408 [MEDIUM] CVE-2024-0408: xorg-server - A flaw was found in the X.Org server. The GLX PBuffer code does not call the XAC... A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never

CVE-2023-6816 [CRITICAL] CVE-2023-6816: xorg-server - A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer r... A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used. Scope: local boo

CVE-2023-5367 [HIGH] CVE-2023-5367: xorg-server - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs d... A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service. Scope: loc

CVE-2023-6478 [HIGH] CVE-2023-6478: xorg-server - A flaw was found in xorg-server. A specially crafted request to RRChangeProvider... A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information. Scope: local bookworm: resolved (fixed in 2:21.1.7-3+deb12u3) bullseye: resolved (fixed in 2:1.20.11-1+deb11u9) forky: resolved (fixed in 2:21.1.10-1) sid: resolv

CVE-2023-0494 [HIGH] CVE-2023-0494: xorg-server - A vulnerability was found in X.Org. This issue occurs due to a dangling pointer ... A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. Sc

CVE-2023-1393 [HIGH] CVE-2023-1393: xorg-server - A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to lo... A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later. Scope: local bookworm: resolved (fixed in 2:21.1.7-2) bul

CVE-2023-6377 [HIGH] CVE-2023-6377: xorg-server - A flaw was found in xorg-server. Querying or changing XKB button actions such as... A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved. Scope: local bookworm: resolved (fixed in 2:21.1.7-3+deb12u4) bullseye: resolve

CVE-2023-5574 [HIGH] CVE-2023-5574: xorg-server - A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xv... A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for p

CVE-2023-5380 [MEDIUM] CVE-2023-5380: xorg-server - A use-after-free flaw was found in the xorg-x11-server. An X server crash may oc... A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by anot

CVE-2022-46343 [HIGH] CVE-2022-46343: xorg-server - A vulnerability was found in X.Org. This security flaw occurs because the handle... A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. Scope: local bookworm: resolved (fixe

CVE-2022-2320 [HIGH] CVE-2022-2320: xorg-server - A flaw was found in the Xorg-x11-server. The specific flaw exists within the han... A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker to escalate privileges and execute arbitrary code in the context of

CVE-2022-2319 [HIGH] CVE-2022-2319: xorg-server - A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur... A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length. Scope: local bookworm: resolved (fixed in 2:21.1.4-1) bullseye: resolved (fixed in 2:1.20.11-1+deb11u2) forky: resolved (fixed in 2:21.1.4-1) sid: resolved (fixed in 2:21.1.4-1) trixie: resolved (fixe

CVE-2022-46341 [HIGH] CVE-2022-46341: xorg-server - A vulnerability was found in X.Org. This security flaw occurs because the handle... A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. Scope: local

CVE-2022-4283 [HIGH] CVE-2022-4283: xorg-server - A vulnerability was found in X.Org. This security flaw occurs because the XkbCop... A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwardin