* [ISSUE] X.org vulnerability and releases
@ 2023-04-02 8:51 Dieken
2023-04-02 14:21 ` [ISSUE] [CLOSED] " Dieken
0 siblings, 1 reply; 2+ messages in thread
From: Dieken @ 2023-04-02 8:51 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 1257 bytes --]
New issue by Dieken on void-packages repository
https://github.com/void-linux/void-packages/issues/43174
Description:
https://github.com/void-linux/void-packages/blob/836b6c484e0b9de2f0f9b8ac2f646e99136e56e8/srcpkgs/xorg-server/template#L3
https://github.com/void-linux/void-packages/blob/836b6c484e0b9de2f0f9b8ac2f646e99136e56e8/srcpkgs/xorg-server-xwayland/template#L3
https://lwn.net/Articles/927887/
The X.Org project has [announced](https://lists.x.org/archives/xorg-announce/2023-March/003374.html) a vulnerability in its X server and Xwayland (CVE-2023-1393).
> This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
>
> [...] If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later.
That has led to the release of [xorg-server 21.1.8](https://lists.x.org/archives/xorg-announce/2023-March/003377.html), [xwayland 22.1.9](https://lists.x.org/archives/xorg-announce/2023-March/003375.html), and [xwayland 23.1.1](https://lists.x.org/archives/xorg-announce/2023-March/003376.html).
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [ISSUE] [CLOSED] X.org vulnerability and releases
2023-04-02 8:51 [ISSUE] X.org vulnerability and releases Dieken
@ 2023-04-02 14:21 ` Dieken
0 siblings, 0 replies; 2+ messages in thread
From: Dieken @ 2023-04-02 14:21 UTC (permalink / raw)
To: ml
[-- Attachment #1: Type: text/plain, Size: 1260 bytes --]
Closed issue by Dieken on void-packages repository
https://github.com/void-linux/void-packages/issues/43174
Description:
https://github.com/void-linux/void-packages/blob/836b6c484e0b9de2f0f9b8ac2f646e99136e56e8/srcpkgs/xorg-server/template#L3
https://github.com/void-linux/void-packages/blob/836b6c484e0b9de2f0f9b8ac2f646e99136e56e8/srcpkgs/xorg-server-xwayland/template#L3
https://lwn.net/Articles/927887/
The X.Org project has [announced](https://lists.x.org/archives/xorg-announce/2023-March/003374.html) a vulnerability in its X server and Xwayland (CVE-2023-1393).
> This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
>
> [...] If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later.
That has led to the release of [xorg-server 21.1.8](https://lists.x.org/archives/xorg-announce/2023-March/003377.html), [xwayland 22.1.9](https://lists.x.org/archives/xorg-announce/2023-March/003375.html), and [xwayland 23.1.1](https://lists.x.org/archives/xorg-announce/2023-March/003376.html).
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-04-02 14:21 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-04-02 8:51 [ISSUE] X.org vulnerability and releases Dieken
2023-04-02 14:21 ` [ISSUE] [CLOSED] " Dieken
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).