Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS-2024-2455

Related Vulnerabilities: CVE-2023-6816   CVE-2024-0229   CVE-2024-0408   CVE-2024-0409   CVE-2024-21885   CVE-2024-21886  

Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer NOTE: https://lists.x.org/archives/xorg/2024-January/061525.htmlNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 (CVE-2023-6816) Reattaching to different master device may lead to out-of-bounds memory access NOTE: https://lists.x.org/archives/xorg/2024-January/061525.htmlNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/ece23be888a93b741aa1209d1dbf64636109d6a5NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/219c54b8a3337456ce5270ded6a67bcde53553d5NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/df3c65706eb169d5938df0052059f3e0d5981b74 (CVE-2024-0229) SELinux unlabeled GLX PBuffer NOTE: https://lists.x.org/archives/xorg/2024-January/061525.htmlNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/e5e8586a12a3ec915673edffa10dc8fe5e15dac3 (CVE-2024-0408) SELinux context corruption NOTE: https://lists.x.org/archives/xorg/2024-January/061525.htmlNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/2ef0f1116c65d5cb06d7b6d83f8a1aea702c94f7 (CVE-2024-0409) Heap buffer overflow in XISendDeviceHierarchyEvent NOTE: https://lists.x.org/archives/xorg/2024-January/061525.htmlNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/4a5e9b1895627d40d26045bd0b7ef3dce503cbd1 (CVE-2024-21885) Heap buffer overflow in DisableDevice NOTE: https://lists.x.org/archives/xorg/2024-January/061525.htmlNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/bc1fdbe46559dd947674375946bbef54dd0ce36bNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8 (CVE-2024-21886)

Source

ALAS-2024-2455

Amazon Linux 2 Security Advisory: ALAS-2024-2455
Advisory Release Date: 2024-02-15 03:52 Pacific
Advisory Updated Date: 2024-02-19 17:37 Pacific
Severity: Important
Issue Overview:

Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer

NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 (CVE-2023-6816)

Reattaching to different master device may lead to out-of-bounds memory access

NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/ece23be888a93b741aa1209d1dbf64636109d6a5
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/219c54b8a3337456ce5270ded6a67bcde53553d5
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/df3c65706eb169d5938df0052059f3e0d5981b74 (CVE-2024-0229)

SELinux unlabeled GLX PBuffer

NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/e5e8586a12a3ec915673edffa10dc8fe5e15dac3 (CVE-2024-0408)

SELinux context corruption

NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/2ef0f1116c65d5cb06d7b6d83f8a1aea702c94f7 (CVE-2024-0409)

Heap buffer overflow in XISendDeviceHierarchyEvent

NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/4a5e9b1895627d40d26045bd0b7ef3dce503cbd1 (CVE-2024-21885)

Heap buffer overflow in DisableDevice

NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/bc1fdbe46559dd947674375946bbef54dd0ce36b
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8 (CVE-2024-21886)


Affected Packages:

xorg-x11-server


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update xorg-x11-server to update your system.

New Packages:
aarch64:
    xorg-x11-server-common-1.20.4-22.amzn2.0.4.aarch64
    xorg-x11-server-Xorg-1.20.4-22.amzn2.0.4.aarch64
    xorg-x11-server-Xnest-1.20.4-22.amzn2.0.4.aarch64
    xorg-x11-server-Xdmx-1.20.4-22.amzn2.0.4.aarch64
    xorg-x11-server-Xvfb-1.20.4-22.amzn2.0.4.aarch64
    xorg-x11-server-Xephyr-1.20.4-22.amzn2.0.4.aarch64
    xorg-x11-server-Xwayland-1.20.4-22.amzn2.0.4.aarch64
    xorg-x11-server-devel-1.20.4-22.amzn2.0.4.aarch64
    xorg-x11-server-debuginfo-1.20.4-22.amzn2.0.4.aarch64

i686:
    xorg-x11-server-common-1.20.4-22.amzn2.0.4.i686
    xorg-x11-server-Xorg-1.20.4-22.amzn2.0.4.i686
    xorg-x11-server-Xnest-1.20.4-22.amzn2.0.4.i686
    xorg-x11-server-Xdmx-1.20.4-22.amzn2.0.4.i686
    xorg-x11-server-Xvfb-1.20.4-22.amzn2.0.4.i686
    xorg-x11-server-Xephyr-1.20.4-22.amzn2.0.4.i686
    xorg-x11-server-Xwayland-1.20.4-22.amzn2.0.4.i686
    xorg-x11-server-devel-1.20.4-22.amzn2.0.4.i686
    xorg-x11-server-debuginfo-1.20.4-22.amzn2.0.4.i686

noarch:
    xorg-x11-server-source-1.20.4-22.amzn2.0.4.noarch

src:
    xorg-x11-server-1.20.4-22.amzn2.0.4.src

x86_64:
    xorg-x11-server-common-1.20.4-22.amzn2.0.4.x86_64
    xorg-x11-server-Xorg-1.20.4-22.amzn2.0.4.x86_64
    xorg-x11-server-Xnest-1.20.4-22.amzn2.0.4.x86_64
    xorg-x11-server-Xdmx-1.20.4-22.amzn2.0.4.x86_64
    xorg-x11-server-Xvfb-1.20.4-22.amzn2.0.4.x86_64
    xorg-x11-server-Xephyr-1.20.4-22.amzn2.0.4.x86_64
    xorg-x11-server-Xwayland-1.20.4-22.amzn2.0.4.x86_64
    xorg-x11-server-devel-1.20.4-22.amzn2.0.4.x86_64
    xorg-x11-server-debuginfo-1.20.4-22.amzn2.0.4.x86_64

Additional References

Red Hat: CVE-2023-6816, CVE-2024-0229, CVE-2024-0408, CVE-2024-0409, CVE-2024-21885, CVE-2024-21886

Mitre: CVE-2023-6816, CVE-2024-0229, CVE-2024-0408, CVE-2024-0409, CVE-2024-21885, CVE-2024-21886

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started