An update for xorg-x11-server-xwayland is now available for openEuler-22.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2024-1548 Final 1.0 1.0 2024-05-10 Initial 2024-05-10 2024-05-10 openEuler SA Tool V1.0 2024-05-10 xorg-x11-server-xwayland security update An update for xorg-x11-server-xwayland is now available for openEuler-22.03-LTS-SP1. Xwayland is an X server for running X clients under Wayland. Security Fix(es): A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.(CVE-2023-6478) A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.(CVE-2023-6816) A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.(CVE-2024-0408) A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.(CVE-2024-31080) A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads.(CVE-2024-31081) An update for xorg-x11-server-xwayland is now available for openEuler-22.03-LTS-SP1. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High xorg-x11-server-xwayland https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1548 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-6478 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2023-6816 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2024-0408 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2024-31080 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2024-31081 https://nvd.nist.gov/vuln/detail/CVE-2023-6478 https://nvd.nist.gov/vuln/detail/CVE-2023-6816 https://nvd.nist.gov/vuln/detail/CVE-2024-0408 https://nvd.nist.gov/vuln/detail/CVE-2024-31080 https://nvd.nist.gov/vuln/detail/CVE-2024-31081 openEuler-22.03-LTS-SP1 xorg-x11-server-Xwayland-debuginfo-22.1.2-4.oe2203sp1.aarch64.rpm xorg-x11-server-Xwayland-debugsource-22.1.2-4.oe2203sp1.aarch64.rpm xorg-x11-server-Xwayland-devel-22.1.2-4.oe2203sp1.aarch64.rpm xorg-x11-server-Xwayland-22.1.2-4.oe2203sp1.aarch64.rpm xorg-x11-server-Xwayland-22.1.2-4.oe2203sp1.src.rpm xorg-x11-server-Xwayland-22.1.2-4.oe2203sp1.x86_64.rpm xorg-x11-server-Xwayland-debugsource-22.1.2-4.oe2203sp1.x86_64.rpm xorg-x11-server-Xwayland-devel-22.1.2-4.oe2203sp1.x86_64.rpm xorg-x11-server-Xwayland-debuginfo-22.1.2-4.oe2203sp1.x86_64.rpm A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information. 2024-05-10 CVE-2023-6478 openEuler-22.03-LTS-SP1 High 7.5 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N xorg-x11-server-xwayland security update 2024-05-10 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1548 A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device s particular number of buttons, leading to a heap overflow if a bigger value was used. 2024-05-10 CVE-2023-6816 openEuler-22.03-LTS-SP1 High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H xorg-x11-server-xwayland security update 2024-05-10 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1548 A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL. 2024-05-10 CVE-2024-0408 openEuler-22.03-LTS-SP1 Medium 5.5 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H xorg-x11-server-xwayland security update 2024-05-10 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1548 A heap-based buffer over-read vulnerability was found in the X.org server s ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker s inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. 2024-05-10 CVE-2024-31080 openEuler-22.03-LTS-SP1 High 7.3 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H xorg-x11-server-xwayland security update 2024-05-10 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1548 A heap-based buffer over-read vulnerability was found in the X.org server s ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker s inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. 2024-05-10 CVE-2024-31081 openEuler-22.03-LTS-SP1 High 7.3 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H xorg-x11-server-xwayland security update 2024-05-10 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1548