CVE-2022-46340

Опубликовано: 14 дек. 2022

Источник: nvd

CVSS3: 8.8

EPSS Низкий

Описание

A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.

Ссылки

https://access.redhat.com/security/cve/CVE-2022-46340
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2151755
Issue Tracking
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWTH3SNJ3GKYDSN7I3QDGWYEPSMWU6EP/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202305-30
https://www.debian.org/security/2022/dsa-5304
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2022-46340
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2151755
Issue Tracking
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RWTH3SNJ3GKYDSN7I3QDGWYEPSMWU6EP/
Mailing List
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/
Mailing List
Third Party Advisory
https://security.gentoo.org/glsa/202305-30
https://www.debian.org/security/2022/dsa-5304
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:x.org:x_server:1.20.4:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

EPSS

Процентиль: 76%

0.01012

Низкий

8.8 High

CVSS3

Дефекты

CWE-787

Связанные уязвимости

CVE-2022-46340

CVSS3: 8.8

ubuntu

больше 2 лет назад

CVE-2022-46340

CVSS3: 8.8

redhat

больше 2 лет назад

CVE-2022-46340

CVSS3: 8.8

debian

больше 2 лет назад

A vulnerability was found in X.Org. This security flaw occurs becuase ...

SUSE-SU-2023:0731-1

suse-cvrf

больше 2 лет назад

Security update for xorg-x11-server

SUSE-SU-2023:0683-1

suse-cvrf

больше 2 лет назад

Security update for xorg-x11-server

EPSS

Процентиль: 76%

0.01012

Низкий

8.8 High

CVSS3

Дефекты

CWE-787