Debian dsa-5657 : xdmx - security update

high Nessus Plugin ID 193288

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5657 advisory.

- A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. (CVE-2024-31080)

- A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly when triggered by a client with a different endianness. This vulnerability could be exploited by an attacker to cause the X server to read heap memory values and then transmit them back to the client until encountering an unmapped page, resulting in a crash. Despite the attacker's inability to control the specific memory copied into the replies, the small length values typically stored in a 32-bit integer can result in significant attempted out-of-bounds reads. (CVE-2024-31081)

- A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request. (CVE-2024-31083)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the xdmx packages.

Plugin Details

Severity: High

ID: 193288

File Name: debian_DSA-5657.nasl

Version: 1.0

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 4/13/2024

Updated: 4/13/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: High

Base Score: 8

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:C

CVSS Score Source: CVE-2024-31081

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2024-31083

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:xnest, p-cpe:/a:debian:debian_linux:xserver-xorg-core, cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:xserver-xorg-core-udeb, p-cpe:/a:debian:debian_linux:xdmx, p-cpe:/a:debian:debian_linux:xwayland, p-cpe:/a:debian:debian_linux:xdmx-tools, p-cpe:/a:debian:debian_linux:xserver-common, p-cpe:/a:debian:debian_linux:xvfb, p-cpe:/a:debian:debian_linux:xserver-xephyr, p-cpe:/a:debian:debian_linux:xserver-xorg-dev, p-cpe:/a:debian:debian_linux:xorg-server-source, cpe:/o:debian:debian_linux:12.0, p-cpe:/a:debian:debian_linux:xserver-xorg-legacy

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 4/12/2024

Vulnerability Publication Date: 4/4/2024

Reference Information

CVE: CVE-2024-31080, CVE-2024-31081, CVE-2024-31083

Detections

Analytics