wid-sec-w-2023-3131
Vulnerability from csaf_certbund
Published
2023-12-12 23:00
Modified
2024-05-21 22:00
Summary
X.Org X11: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Das X Window System dient der Erzeugung grafischer Oberflächen auf Unix Systemen.
Xming ist ein X-Server für Windows mit grafischem Interface.
Angriff
Ein lokaler Angreifer kann mehrere Schwachstellen in X.Org X11 und Xming ausnutzen, um seine Privilegien zu erhöhen oder Informationen offenzulegen.
Betroffene Betriebssysteme
- Linux
- Sonstiges
- UNIX
- Windows
{ "document": { "aggregate_severity": { "text": "mittel" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "Das X Window System dient der Erzeugung grafischer Oberfl\u00e4chen auf Unix Systemen.\r\nXming ist ein X-Server f\u00fcr Windows mit grafischem Interface.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein lokaler Angreifer kann mehrere Schwachstellen in X.Org X11 und Xming ausnutzen, um seine Privilegien zu erh\u00f6hen oder Informationen offenzulegen.", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- Sonstiges\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2023-3131 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3131.json" }, { "category": "self", "summary": "WID-SEC-2023-3131 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3131" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2024-1900 vom 2024-01-09", "url": "https://alas.aws.amazon.com/ALAS-2024-1900.html" }, { "category": "external", "summary": "X.Org Security Advisory vom 2023-12-12", "url": "https://www.mail-archive.com/xorg-announce@lists.x.org/msg01644.html" }, { "category": "external", "summary": "Xming Changelog vom 2023-12-12", "url": "http://www.straightrunning.com/XmingNotes/changes.php" }, { "category": "external", "summary": "Debian Security Advisory DLA-3686 vom 2023-12-13", "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html" }, { "category": "external", "summary": "Amazon Linux Security Advisory ALAS-2024-2378 vom 2024-01-10", "url": "https://alas.aws.amazon.com/AL2/ALAS-2024-2378.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4790-1 vom 2023-12-13", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017329.html" }, { "category": "external", "summary": "Debian Security Advisory DSA-5576 vom 2023-12-13", "url": "https://www.debian.org/security/2023/dsa-5576" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4789-1 vom 2023-12-13", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017330.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4791-1 vom 2023-12-13", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017328.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4792-1 vom 2023-12-13", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017327.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-6555-1 vom 2023-12-13", "url": "https://ubuntu.com/security/notices/USN-6555-1" }, { "category": "external", "summary": "Ubuntu Security Notice USN-6555-2 vom 2023-12-13", "url": "https://ubuntu.com/security/notices/USN-6555-2" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4787-1 vom 2023-12-13", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017332.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4788-1 vom 2023-12-13", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017331.html" }, { "category": "external", "summary": "OpenBSD 7.4 errata", "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/010_xserver.patch.sig" }, { "category": "external", "summary": "Gentoo Linux Security Advisory GLSA-202401-30 vom 2024-01-31", "url": "https://security.gentoo.org/glsa/202401-30" }, { "category": "external", "summary": "CentOS Security Advisory CESA-2024:0009 vom 2024-01-12", "url": "https://lists.centos.org/pipermail/centos-announce/2024-January/099174.html" }, { "category": "external", "summary": "CentOS Security Advisory CESA-2024:0006 vom 2024-01-12", "url": "https://lists.centos.org/pipermail/centos-announce/2024-January/099175.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-0629 vom 2024-02-01", "url": "https://linux.oracle.com/errata/ELSA-2024-0629.html" }, { "category": "external", "summary": "IGEL Security Notice ISN-2023-38 vom 2023-12-19", "url": "https://kb.igel.com/securitysafety/en/isn-2023-38-x-org-vulnerabilities-108345404.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4925-1 vom 2023-12-20", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017496.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2023:7886 vom 2023-12-20", "url": "https://access.redhat.com/errata/RHSA-2023:7886" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4935-1 vom 2023-12-20", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017511.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4934-1 vom 2023-12-20", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017512.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4933-1 vom 2023-12-20", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017513.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4926-1 vom 2023-12-20", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017495.html" }, { "category": "external", "summary": "SUSE Security Update SUSE-SU-2023:4949-1 vom 2023-12-22", "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017528.html" }, { "category": "external", "summary": "Ubuntu Security Notice USN-6587-5 vom 2024-03-13", "url": "https://ubuntu.com/security/notices/USN-6587-5" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0017 vom 2024-01-02", "url": "http://access.redhat.com/errata/RHSA-2024:0017" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0006 vom 2024-01-02", "url": "http://access.redhat.com/errata/RHSA-2024:0006" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0015 vom 2024-01-02", "url": "http://access.redhat.com/errata/RHSA-2024:0015" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0016 vom 2024-01-02", "url": "https://access.redhat.com/errata/RHSA-2024:0016" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0020 vom 2024-01-02", "url": "https://access.redhat.com/errata/RHSA-2024:0020" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0014 vom 2024-01-02", "url": "https://access.redhat.com/errata/RHSA-2024:0014" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-0009 vom 2024-01-03", "url": "https://linux.oracle.com/errata/ELSA-2024-0009.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0009 vom 2024-01-02", "url": "https://access.redhat.com/errata/RHSA-2024:0009" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0010 vom 2024-01-02", "url": "https://access.redhat.com/errata/RHSA-2024:0010" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:0018 vom 2024-01-02", "url": "https://access.redhat.com/errata/RHSA-2024:0018" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-0010 vom 2024-01-03", "url": "https://linux.oracle.com/errata/ELSA-2024-0010.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-0006 vom 2024-01-03", "url": "http://linux.oracle.com/errata/ELSA-2024-0006.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-0018 vom 2024-01-04", "url": "http://linux.oracle.com/errata/ELSA-2024-0018.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-2037 vom 2024-04-25", "url": "http://linux.oracle.com/errata/ELSA-2024-2037.html" }, { "category": "external", "summary": "Oracle Linux Security Advisory ELSA-2024-2080 vom 2024-04-30", "url": "https://linux.oracle.com/errata/ELSA-2024-2080.html" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:2169 vom 2024-04-30", "url": "https://access.redhat.com/errata/RHSA-2024:2169" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:2996 vom 2024-05-22", "url": "https://access.redhat.com/errata/RHSA-2024:2996" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2024:2995 vom 2024-05-22", "url": "https://access.redhat.com/errata/RHSA-2024:2995" } ], "source_lang": "en-US", "title": "X.Org X11: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-21T22:00:00.000+00:00", "generator": { "date": "2024-05-22T09:07:01.730+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2023-3131", "initial_release_date": "2023-12-12T23:00:00.000+00:00", "revision_history": [ { "date": "2023-12-12T23:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2023-12-13T23:00:00.000+00:00", "number": "2", "summary": "Neue Updates von SUSE, Debian und Ubuntu aufgenommen" }, { "date": "2023-12-14T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates aufgenommen" }, { "date": "2023-12-18T23:00:00.000+00:00", "number": "4", "summary": "Neue Updates von IGEL aufgenommen" }, { "date": "2023-12-20T23:00:00.000+00:00", "number": "5", "summary": "Neue Updates von SUSE und Red Hat aufgenommen" }, { "date": "2023-12-21T23:00:00.000+00:00", "number": "6", "summary": "Neue Updates von SUSE aufgenommen" }, { "date": "2024-01-01T23:00:00.000+00:00", "number": "7", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2024-01-02T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen" }, { "date": "2024-01-03T23:00:00.000+00:00", "number": "9", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-01-04T23:00:00.000+00:00", "number": "10", "summary": "Neue Updates von Zero Day Initiative und Oracle Linux aufgenommen" }, { "date": "2024-01-08T23:00:00.000+00:00", "number": "11", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2024-01-09T23:00:00.000+00:00", "number": "12", "summary": "Neue Updates von Amazon aufgenommen" }, { "date": "2024-01-14T23:00:00.000+00:00", "number": "13", "summary": "Neue Updates von CentOS aufgenommen" }, { "date": "2024-01-31T23:00:00.000+00:00", "number": "14", "summary": "Neue Updates von Gentoo aufgenommen" }, { "date": "2024-02-01T23:00:00.000+00:00", "number": "15", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-03-13T23:00:00.000+00:00", "number": "16", "summary": "Neue Updates von Ubuntu aufgenommen" }, { "date": "2024-04-24T22:00:00.000+00:00", "number": "17", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-04-29T22:00:00.000+00:00", "number": "18", "summary": "Neue Updates von Oracle Linux aufgenommen" }, { "date": "2024-05-21T22:00:00.000+00:00", "number": "19", "summary": "Neue Updates von Red Hat aufgenommen" } ], "status": "final", "version": "19" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "Amazon Linux 2", "product": { "name": "Amazon Linux 2", "product_id": "398363", "product_identification_helper": { "cpe": "cpe:/o:amazon:linux_2:-" } } } ], "category": "vendor", "name": "Amazon" }, { "branches": [ { "category": "product_name", "name": "Debian Linux", "product": { "name": "Debian Linux", "product_id": "2951", "product_identification_helper": { "cpe": "cpe:/o:debian:debian_linux:-" } } } ], "category": "vendor", "name": "Debian" }, { "branches": [ { "category": "product_name", "name": "Gentoo Linux", "product": { "name": "Gentoo Linux", "product_id": "T012167", "product_identification_helper": { "cpe": "cpe:/o:gentoo:linux:-" } } } ], "category": "vendor", "name": "Gentoo" }, { "branches": [ { "category": "product_name", "name": "IGEL OS", "product": { "name": "IGEL OS", "product_id": "T017865", "product_identification_helper": { "cpe": "cpe:/o:igel:os:-" } } } ], "category": "vendor", "name": "IGEL" }, { "branches": [ { "category": "product_name", "name": "Open Source CentOS", "product": { "name": "Open Source CentOS", "product_id": "1727", "product_identification_helper": { "cpe": "cpe:/o:centos:centos:-" } } }, { "branches": [ { "category": "product_version_range", "name": "\u003c21.1.10", "product": { "name": "Open Source X.Org X11 \u003c21.1.10", "product_id": "T031663", "product_identification_helper": { "cpe": "cpe:/a:x:x.org_x11:21.1.10" } } } ], "category": "product_name", "name": "X.Org X11" }, { "branches": [ { "category": "product_version_range", "name": "\u003c7.7.0.98", "product": { "name": "Open Source Xming \u003c7.7.0.98", "product_id": "T031664", "product_identification_helper": { "cpe": "cpe:/a:open_source:xming:7.7.0.98" } } } ], "category": "product_name", "name": "Xming" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "category": "product_name", "name": "OpenBSD OpenBSD", "product": { "name": "OpenBSD OpenBSD", "product_id": "T030792", "product_identification_helper": { "cpe": "cpe:/a:openbsd:openbsd:7.4" } } } ], "category": "vendor", "name": "OpenBSD" }, { "branches": [ { "category": "product_name", "name": "Oracle Linux", "product": { "name": "Oracle Linux", "product_id": "T004914", "product_identification_helper": { "cpe": "cpe:/o:oracle:linux:-" } } } ], "category": "vendor", "name": "Oracle" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "category": "product_name", "name": "SUSE Linux", "product": { "name": "SUSE Linux", "product_id": "T002207", "product_identification_helper": { "cpe": "cpe:/o:suse:suse_linux:-" } } } ], "category": "vendor", "name": "SUSE" }, { "branches": [ { "category": "product_name", "name": "Ubuntu Linux", "product": { "name": "Ubuntu Linux", "product_id": "T000126", "product_identification_helper": { "cpe": "cpe:/o:canonical:ubuntu_linux:-" } } } ], "category": "vendor", "name": "Ubuntu" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-6377", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in X.Org X11 und Xming. Aufgrund eines Begrenzungsfehlers im XKB-Button-Handler beim Umschalten logischer Eingabeger\u00e4te kann ein Out-of-Bounds-Write ausgel\u00f6st werden. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "2951", "T002207", "67646", "T017865", "T000126", "398363", "T012167", "1727", "T004914", "T030792" ] }, "release_date": "2023-12-12T23:00:00Z", "title": "CVE-2023-6377" }, { "cve": "CVE-2023-6478", "notes": [ { "category": "description", "text": "Es existiert eine Schwachstelle in X.Org X11 und Xming. Bei der Verarbeitung von RRChangeProviderProperty- oder RRChangeOutputProperty-Anfragen kommt es unter bestimmten Umst\u00e4nden zu einem Integer-\u00dcberlauf. Ein lokaler Angreifer kann diese Schwachstelle ausnutzen, um Informationen offenzulegen." } ], "product_status": { "known_affected": [ "2951", "T002207", "67646", "T017865", "T000126", "398363", "T012167", "1727", "T004914", "T030792" ] }, "release_date": "2023-12-12T23:00:00Z", "title": "CVE-2023-6478" } ] }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.