First published: Thu Dec 08 2022(Updated: )
CVE-2022-46343/ZDI-CAN-19404: X.Org Server ScreenSaverSetAttributes use-after-free The handler for the ScreenSaverSetAttributes request may write to memory after it has been freed.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
X.Org X Server | =1.20.4 | |
Redhat Enterprise Linux | =6.0 | |
Redhat Enterprise Linux | =7.0 | |
Redhat Enterprise Linux | =8.0 | |
Redhat Enterprise Linux | =9.0 | |
Fedoraproject Fedora | =36 | |
Fedoraproject Fedora | =37 | |
Debian Debian Linux | =11.0 | |
debian/xorg-server | <=2:1.20.4-1+deb10u4 | 2:1.20.4-1+deb10u12 2:1.20.11-1+deb11u6 2:1.20.11-1+deb11u10 2:21.1.7-3+deb12u2 2:21.1.7-3+deb12u4 2:21.1.10-1 |
debian/xwayland | 2:22.1.9-1 2:23.2.3-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of CVE-2022-46343 is high with a severity value of 8.8.
The X.Org X Server versions 2:1.20.4-1+deb10u4, 2:1.20.4-1+deb10u9, 2:1.20.11-1+deb11u6, 2:21.1.7-3, and 2:21.1.8-1 are affected by CVE-2022-46343. The Debian xorg-server package versions mentioned are also affected.
CVE-2022-46343 can be exploited to cause local privileges elevation on systems where the X server is running privileged and remote code execution.
The remedy for CVE-2022-46343 is to update the X.Org X Server to versions 2:1.20.4-1+deb10u9, 2:1.20.11-1+deb11u6, 2:21.1.7-3, or 2:21.1.8-1.
No, Redhat Enterprise Linux versions 6.0, 7.0, 8.0, and 9.0 are not vulnerable to CVE-2022-46343.