CVE-2022-46341
CVSS V2 None
CVSS V3 None
Description
A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.
Overview
- CVE ID
- CVE-2022-46341
- Assigner
- secalert@redhat.com
- Vulnerability Status
- Analyzed
- Published Version
- 2022-12-14T21:15:13
- Last Modified Date
- 2023-03-01T01:50:17
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| AND | ||||
| cpe:2.3:a:x.org:x_server:1.20.4:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 0 | OR | ||
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 0 | OR | ||
| AND | ||||
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 1 | OR |
References
| Reference URL | Reference Tags |
|---|---|
| https://access.redhat.com/security/cve/CVE-2022-46341 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2151756 | Issue Tracking Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5NELB7YDWRABYYBG4UPTHRBDTKJRV5M2/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DXDF2O5PPLE3SVAJJYUOSAD5QZ4TWQ2G/ | Mailing List Third Party Advisory |
| https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z67QC4C3I2FI2WRFIUPEHKC36J362MLA/ | |
| https://www.debian.org/security/2022/dsa-5304 |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2022-46341 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-46341 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-12-14 22:14:54 | Added to TrackCVE | |||
| 2022-12-18 09:30:11 | 2022-12-14T21:15:13.293 | 2022-12-14T21:15:13 | CVE Published Date | updated |
| 2022-12-18 09:30:11 | 2022-12-16T05:15:17 | CVE Modified Date | updated | |
| 2022-12-18 09:30:11 | Awaiting Analysis | Undergoing Analysis | Vulnerability Status | updated |
| 2022-12-18 09:30:18 | References | updated | ||
| 2022-12-19 03:15:35 | 2022-12-19T03:15:10 | CVE Modified Date | updated | |
| 2022-12-19 03:15:36 | References | updated | ||
| 2022-12-20 02:14:49 | 2022-12-20T01:46:16 | CVE Modified Date | updated | |
| 2022-12-20 02:14:49 | Undergoing Analysis | Analyzed | Vulnerability Status | updated |
| 2022-12-20 02:14:49 | CWE-787 | Weakness Enumeration | new | |
| 2022-12-20 02:14:50 | CPE Information | updated | ||
| 2022-12-21 07:02:27 | 2022-12-21T04:15:10 | CVE Modified Date | updated | |
| 2022-12-21 07:02:27 | Analyzed | Modified | Vulnerability Status | updated |
| 2022-12-21 07:02:28 | References | updated | ||
| 2022-12-22 20:15:30 | Modified | Undergoing Analysis | Vulnerability Status | updated |
| 2022-12-26 04:16:12 | 2022-12-26T04:15:10 | CVE Modified Date | updated | |
| 2022-12-26 04:16:12 | References | updated | ||
| 2022-12-27 01:15:31 | 2022-12-27T01:15:10 | CVE Modified Date | updated | |
| 2023-03-01 02:13:14 | 2023-03-01T01:50:17 | CVE Modified Date | updated | |
| 2023-03-01 02:13:14 | Undergoing Analysis | Analyzed | Vulnerability Status | updated |