VDB

GHSA-fjhq-fg7w-hchr

GHSA-fjhq-fg7w-hchr PUBLISHED CVSS 9.300000190734863 CRITICAL

Record from GitHub Advisory Database · Published May 3, 2022

The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuthorization function in the Security extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via requests with crafted length values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.

Risk scores

CVSS 4.0
9.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Timeline

  • May 3, 2022 CVE Published
  • Apr 9, 2026 Distribution Patch (2 in total, the first dated here)
  • Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-fjhq-fg7w-hchr
vulnetix vdb fixes GHSA-fjhq-fg7w-hchr

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-fjhq-fg7w-hchr/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

…and 29 more

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›