USN-6587-2
See a problem?- Source
- https://ubuntu.com/security/notices/USN-6587-2
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-6587-2.json
- JSON Data
- https://api.osv.dev/v1/vulns/USN-6587-2
- Related
- Published
- 2024-01-22T13:13:33.418419Z
- Modified
- 2024-01-22T13:13:33.418419Z
- Summary
- xorg-server vulnerabilities
- Details
-
USN-6587-1 fixed several vulnerabilities in X.Org. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs. An attacker could possibly use this issue to cause the X Server to crash, obtain sensitive information, or execute arbitrary code. (CVE-2023-6816)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled reattaching to a different master device. An attacker could use this issue to cause the X Server to crash, leading to a denial of service, or possibly execute arbitrary code. (CVE-2024-0229)
Olivier Fourdan and Donn Seeley discovered that the X.Org X Server incorrectly labeled GLX PBuffers when used with SELinux. An attacker could use this issue to cause the X Server to crash, leading to a denial of service. (CVE-2024-0408)
Olivier Fourdan discovered that the X.Org X Server incorrectly handled the curser code when used with SELinux. An attacker could use this issue to cause the X Server to crash, leading to a denial of service. (CVE-2024-0409)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the XISendDeviceHierarchyEvent API. An attacker could possibly use this issue to cause the X Server to crash, or execute arbitrary code. (CVE-2024-21885)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled devices being disabled. An attacker could possibly use this issue to cause the X Server to crash, or execute arbitrary code. (CVE-2024-21886)
- References
-
- https://ubuntu.com/security/notices/USN-6587-2
- https://ubuntu.com/security/CVE-2023-6816
- https://ubuntu.com/security/CVE-2024-0229
- https://ubuntu.com/security/CVE-2024-0408
- https://ubuntu.com/security/CVE-2024-0409
- https://ubuntu.com/security/CVE-2024-21885
- https://ubuntu.com/security/CVE-2024-21886
Affected packages
Ubuntu:Pro:16.04:LTS / xorg-server
Package
- Name
- xorg-server
- Purl
- pkg:deb/ubuntu/xorg-server@2:1.18.4-0ubuntu0.12+esm9?arch=src?distro=esm-infra/xenial
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2:1.18.4-0ubuntu0.12+esm9
Affected versions
2:1.*
Ecosystem specific
{
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"xvfb": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-xorg-legacy": "2:1.18.4-0ubuntu0.12+esm9",
"xdmx": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-xorg-core-dbg": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-xorg-core-udeb-dbgsym": "2:1.18.4-0ubuntu0.12+esm9",
"xdmx-tools-dbgsym": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-xorg-dev": "2:1.18.4-0ubuntu0.12+esm9",
"xnest-dbgsym": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-xorg-core": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-common": "2:1.18.4-0ubuntu0.12+esm9",
"xwayland-dbgsym": "2:1.18.4-0ubuntu0.12+esm9",
"xnest": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-xephyr": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-xorg-xmir": "2:1.18.4-0ubuntu0.12+esm9",
"xdmx-tools": "2:1.18.4-0ubuntu0.12+esm9",
"xmir-dbgsym": "2:1.18.4-0ubuntu0.12+esm9",
"xwayland": "2:1.18.4-0ubuntu0.12+esm9",
"xorg-server-source": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-xorg-core-dbgsym": "2:1.18.4-0ubuntu0.12+esm9",
"xmir": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-xephyr-dbgsym": "2:1.18.4-0ubuntu0.12+esm9",
"xdmx-dbgsym": "2:1.18.4-0ubuntu0.12+esm9",
"xvfb-dbgsym": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-xorg-legacy-dbgsym": "2:1.18.4-0ubuntu0.12+esm9",
"xserver-xorg-core-udeb": "2:1.18.4-0ubuntu0.12+esm9"
}
]
}
Ubuntu:Pro:18.04:LTS / xorg-server
Package
- Name
- xorg-server
- Purl
- pkg:deb/ubuntu/xorg-server@2:1.19.6-1ubuntu4.15+esm4?arch=src?distro=esm-infra/bionic
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2:1.19.6-1ubuntu4.15+esm4
Affected versions
2:1.*
Ecosystem specific
{
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro",
"binaries": [
{
"xvfb": "2:1.19.6-1ubuntu4.15+esm4",
"xserver-xorg-legacy": "2:1.19.6-1ubuntu4.15+esm4",
"xdmx": "2:1.19.6-1ubuntu4.15+esm4",
"xdmx-tools-dbgsym": "2:1.19.6-1ubuntu4.15+esm4",
"xserver-xorg-dev": "2:1.19.6-1ubuntu4.15+esm4",
"xnest-dbgsym": "2:1.19.6-1ubuntu4.15+esm4",
"xserver-xorg-core": "2:1.19.6-1ubuntu4.15+esm4",
"xserver-common": "2:1.19.6-1ubuntu4.15+esm4",
"xwayland-dbgsym": "2:1.19.6-1ubuntu4.15+esm4",
"xnest": "2:1.19.6-1ubuntu4.15+esm4",
"xserver-xephyr": "2:1.19.6-1ubuntu4.15+esm4",
"xserver-xorg-xmir": "2:1.19.6-1ubuntu4.15+esm4",
"xdmx-tools": "2:1.19.6-1ubuntu4.15+esm4",
"xmir-dbgsym": "2:1.19.6-1ubuntu4.15+esm4",
"xwayland": "2:1.19.6-1ubuntu4.15+esm4",
"xorg-server-source": "2:1.19.6-1ubuntu4.15+esm4",
"xserver-xorg-core-dbgsym": "2:1.19.6-1ubuntu4.15+esm4",
"xmir": "2:1.19.6-1ubuntu4.15+esm4",
"xserver-xephyr-dbgsym": "2:1.19.6-1ubuntu4.15+esm4",
"xdmx-dbgsym": "2:1.19.6-1ubuntu4.15+esm4",
"xvfb-dbgsym": "2:1.19.6-1ubuntu4.15+esm4",
"xserver-xorg-legacy-dbgsym": "2:1.19.6-1ubuntu4.15+esm4",
"xserver-xorg-core-udeb": "2:1.19.6-1ubuntu4.15+esm4"
}
]
}