MGASA-2023-0131 - Updated tigervnc/x11-server packages fix security vulnerability Publication date: 11 Apr 2023 URL: https://advisories.mageia.org/MGASA-2023-0131.html Type: security Affected Mageia releases: 8 CVE: CVE-2023-1393 A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later. (CVE-2023-1393) References: - https://bugs.mageia.org/show_bug.cgi?id=31732 - https://lists.x.org/archives/xorg-announce/2023-March/003374.html - https://www.debian.org/security/2023/dsa-5380 - https://ubuntu.com/security/notices/USN-5986-1 - https://lists.fedoraproject.org/archives/list/[email protected]/thread/CB62PUAZRE2ZK6PDX6OZ2WSYXDJGBGTS/ - https://access.redhat.com/errata/RHSA-2023:1592 - https://lists.fedoraproject.org/archives/list/[email protected]/thread/SW2NRC3V53PIBXFPFBVWCOM2MDDILWQS/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1393 SRPMS: - 8/core/tigervnc-1.11.0-4.3.mga8 - 8/core/x11-server-1.20.14-4.3.mga8
Mageia 2023-0131: tigervnc/x11-server security update
A flaw was found in X.Org Server Overlay Window
Summary
A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead
to local privilege escalation. If a client explicitly destroys the
compositor overlay window (aka COW), the Xserver would leave a dangling
pointer to that window in the CompScreen structure, which will trigger a
use-after-free later. (CVE-2023-1393)
References
- https://bugs.mageia.org/show_bug.cgi?id=31732
- https://lists.x.org/archives/xorg-announce/2023-March/003374.html
- https://www.debian.org/security/2023/dsa-5380
- https://ubuntu.com/security/notices/USN-5986-1
- https://lists.fedoraproject.org/archives/list/[email protected]/thread/CB62PUAZRE2ZK6PDX6OZ2WSYXDJGBGTS/
- https://access.redhat.com/errata/RHSA-2023:1592
- https://lists.fedoraproject.org/archives/list/[email protected]/thread/SW2NRC3V53PIBXFPFBVWCOM2MDDILWQS/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1393
Resolution
MGASA-2023-0131 - Updated tigervnc/x11-server packages fix security vulnerability
SRPMS
- 8/core/tigervnc-1.11.0-4.3.mga8
- 8/core/x11-server-1.20.14-4.3.mga8
Severity
Publication date: 11 Apr 2023
URL: https://advisories.mageia.org/MGASA-2023-0131.html
Type: security
CVE: CVE-2023-1393
News
HOWTOs
About Us
Powered By
