Advisories » MGASA-2023-0131

Updated tigervnc/x11-server packages fix security vulnerability

Publication date: 11 Apr 2023
Modification date: 11 Apr 2023
Type: security
Affected Mageia releases : 8
CVE: CVE-2023-1393

Description

A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead
to local privilege escalation. If a client explicitly destroys the
compositor overlay window (aka COW), the Xserver would leave a dangling
pointer to that window in the CompScreen structure, which will trigger a
use-after-free later. (CVE-2023-1393)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=31732
• https://lists.x.org/archives/xorg-announce/2023-March/003374.html
• https://www.debian.org/security/2023/dsa-5380
• https://ubuntu.com/security/notices/USN-5986-1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CB62PUAZRE2ZK6PDX6OZ2WSYXDJGBGTS/
• https://access.redhat.com/errata/RHSA-2023:1592
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SW2NRC3V53PIBXFPFBVWCOM2MDDILWQS/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1393

SRPMS

8/core

• tigervnc-1.11.0-4.3.mga8
• x11-server-1.20.14-4.3.mga8