A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.
References
Link | Resource |
---|---|
https://access.redhat.com/security/cve/CVE-2022-46340 | Third Party Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=2151755 | Issue Tracking Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/ | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/ | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWTH3SNJ3GKYDSN7I3QDGWYEPSMWU6EP/ | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/ | Mailing List Third Party Advisory |
https://security.gentoo.org/glsa/202305-30 | |
https://www.debian.org/security/2022/dsa-5304 | Third Party Advisory |
Configurations
Configuration 1 (hide)
AND |
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
30 May 2023, 06:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
01 Mar 2023, 01:51
Type | Values Removed | Values Added |
---|---|---|
First Time |
Debian
Debian debian Linux |
|
References | (DEBIAN) https://www.debian.org/security/2022/dsa-5304 - Third Party Advisory | |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/ - Mailing List, Third Party Advisory | |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/ - Mailing List, Third Party Advisory | |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWTH3SNJ3GKYDSN7I3QDGWYEPSMWU6EP/ - Mailing List, Third Party Advisory | |
References | (MISC) https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/ - Mailing List, Third Party Advisory | |
CPE | cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* |
12 Feb 2023, 22:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Summary | A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order. |
02 Feb 2023, 21:22
Type | Values Removed | Values Added |
---|---|---|
Summary | A vulnerability was found in X.Org. The issue occurs due to the swap handler for the XTestFakeInput request of the XTest extension, possibly corrupting the stack if GenericEvents with lengths larger than 32 bytes are sent through the XTestFakeInput request. This flaw can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where the client and server use the same byte order. | |
References |
|
27 Dec 2022, 01:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
26 Dec 2022, 04:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
21 Dec 2022, 04:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
20 Dec 2022, 13:27
Type | Values Removed | Values Added |
---|---|---|
First Time |
X.org
X.org x Server |
|
CPE | cpe:2.3:a:x.org:x_server:1.20.4:*:*:*:*:*:*:* |
19 Dec 2022, 17:48
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
CPE | cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:a:x:x.org_x11:1.20.4:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
|
References | (MISC) https://access.redhat.com/security/cve/CVE-2022-46340 - Third Party Advisory | |
References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2151755 - Issue Tracking, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/ - Mailing List, Third Party Advisory | |
References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/ - Mailing List, Third Party Advisory | |
CWE | CWE-787 | |
First Time |
Fedoraproject
Redhat enterprise Linux X Redhat Fedoraproject fedora X x.org X11 |
19 Dec 2022, 03:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
16 Dec 2022, 05:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
14 Dec 2022, 21:43
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-12-14 21:15
Updated : 2023-12-10 14:48
NVD link : CVE-2022-46340
Mitre link : CVE-2022-46340
CVE.ORG link : CVE-2022-46340
JSON object : View
Products Affected
x.org
- x_server
debian
- debian_linux
redhat
- enterprise_linux
fedoraproject
- fedora
CWE
CWE-787
Out-of-bounds Write