A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
The product reads data past the end, or before the beginning, of the intended buffer.
| Link | Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2022-46344 | third party advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2151760 | issue tracking third party advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/ | mailing list third party advisory vendor advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/ | mailing list third party advisory vendor advisory |
| https://www.debian.org/security/2022/dsa-5304 | third party advisory vendor advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/ | mailing list third party advisory vendor advisory |
| https://security.gentoo.org/glsa/202305-30 | |
| http://www.openwall.com/lists/oss-security/2023/12/13/1 |