CVE-2022-46343

A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
redhatCNA
---
---
CVEADP
---
---
CISA-ADPADP
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 75%
VendorProductVersion
x.orgx_server
1.20.4
debiandebian_linux
11.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
xorg-server
bullseye
2:1.20.11-1+deb11u13
fixed
bullseye (security)
2:1.20.11-1+deb11u14
fixed
bookworm
2:21.1.7-3+deb12u7
fixed
bookworm (security)
2:21.1.7-3+deb12u8
fixed
sid
2:21.1.14-1
fixed
trixie
2:21.1.14-1
fixed
xwayland
bookworm
2:22.1.9-1
fixed
sid
2:24.1.4-1
fixed
trixie
2:24.1.4-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
xorg-server
lunar
Fixed 2:21.1.5-1ubuntu1
released
kinetic
Fixed 2:21.1.4-2ubuntu1.3
released
jammy
Fixed 2:21.1.3-2ubuntu2.5
released
focal
Fixed 2:1.20.13-1ubuntu1~20.04.5
released
bionic
Fixed 2:1.19.6-1ubuntu4.13
released
xenial
Fixed 2:1.18.4-0ubuntu0.12+esm5
released
trusty
Fixed 2:1.15.1-0ubuntu2.11+esm7
released
xorg-server-hwe-16.04
kinetic
dne
jammy
dne
focal
dne
bionic
dne
xenial
Fixed 2:1.19.6-1ubuntu4.1~16.04.6+esm4
released
trusty
dne
xorg-server-hwe-18.04
kinetic
dne
jammy
dne
focal
dne
bionic
Fixed 2:1.20.8-2ubuntu2.2~18.04.9
released
xenial
dne
trusty
dne
xorg-server-lts-utopic
kinetic
dne
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
ignored
xorg-server-lts-vivid
kinetic
dne
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
ignored
xorg-server-lts-wily
kinetic
dne
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
ignored
xorg-server-lts-xenial
kinetic
dne
jammy
dne
focal
dne
bionic
dne
xenial
dne
trusty
ignored
xwayland
lunar
Fixed 2:22.1.6-1
released
kinetic
Fixed 2:22.1.3-2ubuntu0.2
released
jammy
Fixed 2:22.1.1-1ubuntu0.4
released
focal
dne
bionic
dne
xenial
dne
trusty
dne
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2022-46343
https://bugzilla.redhat.com/show_bug.cgi?id=2151758
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/
https://security.gentoo.org/glsa/202305-30
https://www.debian.org/security/2022/dsa-5304
https://access.redhat.com/security/cve/CVE-2022-46343
https://bugzilla.redhat.com/show_bug.cgi?id=2151758
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/
https://security.gentoo.org/glsa/202305-30
https://www.debian.org/security/2022/dsa-5304