Linux · Security advisory · May 23, 2024

ELSA-2024-2995: Security update for 8 packages

ELSA-2024-2995, released May 23, 2024, fixes 9 CVEs across 8 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
9
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0162
76th percentile

Priority of the 9 CVEs

Patch now 0 Urgent 0 High 7 Routine 2

Fixed package versions

ProductReleaseFixed in
xorg-x11-server-Xdmxol 80:1.20.11-22.el8
xorg-x11-server-Xephyrol 80:1.20.11-22.el8
xorg-x11-server-Xnestol 80:1.20.11-22.el8
xorg-x11-server-Xorgol 80:1.20.11-22.el8
xorg-x11-server-Xvfbol 80:1.20.11-22.el8
xorg-x11-server-commonol 80:1.20.11-22.el8
xorg-x11-server-develol 80:1.20.11-22.el8
xorg-x11-server-sourceol 80:1.20.11-22.el8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-6478 xnest: A flaw was found in xorg-server 7.6 0.0162 None reported
High CVE-2023-6377 xnest: A flaw was found in xorg-server 7.8 0.0157 None reported
High CVE-2024-21885 xwayland: A flaw was found in X.Org server 7.8 0.0142 None reported
High CVE-2024-21886 xnest: A heap buffer overflow flaw was found in the DisableDevice function in theX.Org server 7.8 0.0142 None reported
High CVE-2024-0229 xnest: An out-of-bounds memory access flaw was found in the X.Org server 7.8 0.0123 None reported
High CVE-2023-5367 xnest: A out-of-bounds write flaw was found in the xorg-x11-server 7.8 0.0061 None reported
High CVE-2024-0409 xnest: A flaw was found in the X.Org server 7.8 0.0036 None reported
Routine CVE-2023-5380 xnest: A use-after-free flaw was found in the xorg-x11-server 4.7 0.0070 None reported
Routine CVE-2024-0408 xnest: A flaw was found in the X.Org server 5.5 0.0032 None reported
Showing 1 to 9 of 9 1