VDB

CISA-2022-4283

CISA-2022-4283 PUBLISHED CVSS 7.8 HIGH

Reported by redhat · Published December 14, 2022

A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.

Risk Scores

CVSS 3.1
7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
n/axorg-x11-serverxorg-x11-server-1.20.4
n/axorg-x11-serverxorg-x11-server-1.20.4, *

Timeline

  • Dec 14, 2022 CVE Published
  • Apr 14, 2025 CVE Updated
  • Apr 26, 2026 Distribution Patch
  • Apr 26, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›