Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

ALAS-2024-1932

Related Vulnerabilities: CVE-2023-6816   CVE-2024-0229   CVE-2024-21885   CVE-2024-21886  

Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer NOTE: https://lists.x.org/archives/xorg/2024-January/061525.htmlNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 (CVE-2023-6816) Reattaching to different master device may lead to out-of-bounds memory access NOTE: https://lists.x.org/archives/xorg/2024-January/061525.htmlNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/ece23be888a93b741aa1209d1dbf64636109d6a5NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/219c54b8a3337456ce5270ded6a67bcde53553d5NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/df3c65706eb169d5938df0052059f3e0d5981b74 (CVE-2024-0229) Heap buffer overflow in XISendDeviceHierarchyEvent NOTE: https://lists.x.org/archives/xorg/2024-January/061525.htmlNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/4a5e9b1895627d40d26045bd0b7ef3dce503cbd1 (CVE-2024-21885) Heap buffer overflow in DisableDevice NOTE: https://lists.x.org/archives/xorg/2024-January/061525.htmlNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/bc1fdbe46559dd947674375946bbef54dd0ce36bNOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8 (CVE-2024-21886)

Source

ALAS-2024-1932

Amazon Linux 1 Security Advisory: ALAS-2024-1932
Advisory Release Date: 2024-04-25 16:04 Pacific
Advisory Updated Date: 2024-04-25 16:04 Pacific
Severity: Important
Issue Overview:

Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer

NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 (CVE-2023-6816)

Reattaching to different master device may lead to out-of-bounds memory access

NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/ece23be888a93b741aa1209d1dbf64636109d6a5
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/219c54b8a3337456ce5270ded6a67bcde53553d5
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/df3c65706eb169d5938df0052059f3e0d5981b74 (CVE-2024-0229)

Heap buffer overflow in XISendDeviceHierarchyEvent

NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/4a5e9b1895627d40d26045bd0b7ef3dce503cbd1 (CVE-2024-21885)

Heap buffer overflow in DisableDevice

NOTE: https://lists.x.org/archives/xorg/2024-January/061525.html
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/bc1fdbe46559dd947674375946bbef54dd0ce36b
NOTE: https://gitlab.freedesktop.org/xorg/xserver/-/commit/26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8 (CVE-2024-21886)


Affected Packages:

xorg-x11-server


Issue Correction:
Run yum update xorg-x11-server to update your system.

New Packages:
i686:
    xorg-x11-server-Xephyr-1.17.4-18.56.amzn1.i686
    xorg-x11-server-Xorg-1.17.4-18.56.amzn1.i686
    xorg-x11-server-Xdmx-1.17.4-18.56.amzn1.i686
    xorg-x11-server-Xnest-1.17.4-18.56.amzn1.i686
    xorg-x11-server-devel-1.17.4-18.56.amzn1.i686
    xorg-x11-server-common-1.17.4-18.56.amzn1.i686
    xorg-x11-server-debuginfo-1.17.4-18.56.amzn1.i686
    xorg-x11-server-Xvfb-1.17.4-18.56.amzn1.i686

noarch:
    xorg-x11-server-source-1.17.4-18.56.amzn1.noarch

src:
    xorg-x11-server-1.17.4-18.56.amzn1.src

x86_64:
    xorg-x11-server-common-1.17.4-18.56.amzn1.x86_64
    xorg-x11-server-Xnest-1.17.4-18.56.amzn1.x86_64
    xorg-x11-server-devel-1.17.4-18.56.amzn1.x86_64
    xorg-x11-server-debuginfo-1.17.4-18.56.amzn1.x86_64
    xorg-x11-server-Xvfb-1.17.4-18.56.amzn1.x86_64
    xorg-x11-server-Xephyr-1.17.4-18.56.amzn1.x86_64
    xorg-x11-server-Xorg-1.17.4-18.56.amzn1.x86_64
    xorg-x11-server-Xdmx-1.17.4-18.56.amzn1.x86_64

Additional References

Red Hat: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886

Mitre: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook

Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started