Detections
Analytics
Slackware Linux 15.0 / current xorg-server Multiple Vulnerabilities (SSA:2022-290-01)
high Nessus Plugin ID 166174
Language:
Synopsis
The remote Slackware Linux host is missing a security update to xorg-server.Description
The version of xorg-server installed on the remote host is prior to 1.20.14 / 21.1.4 / 22.1.3. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-290-01 advisory.- A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051. (CVE-2022-3550)
- A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052.
(CVE-2022-3551)
- A vulnerability, which was classified as problematic, was found in X.org Server. This affects an unknown part of the file hw/xquartz/X11Controller.m of the component xquartz. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier VDB-211053 was assigned to this vulnerability. (CVE-2022-3553)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade the affected xorg-server package.Plugin Details
Severity: High
ID: 166174
File Name: Slackware_SSA_2022-290-01.nasl
Version: 1.6
Type: local
Family: Slackware Local Security Checks
Published: 10/17/2022
Updated: 12/1/2022
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 6.7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2022-3550
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:slackware:slackware_linux:xorg-server-xephyr, p-cpe:/a:slackware:slackware_linux:xorg-server-xnest, cpe:/o:slackware:slackware_linux:15.0, p-cpe:/a:slackware:slackware_linux:xorg-server-xvfb, cpe:/o:slackware:slackware_linux, p-cpe:/a:slackware:slackware_linux:xorg-server-xwayland, p-cpe:/a:slackware:slackware_linux:xorg-server
Required KB Items: Host/local_checks_enabled, Host/Slackware/release, Host/Slackware/packages
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 10/17/2022