MGASA-2023-0131 - Updated tigervnc/x11-server packages fix security vulnerability

Publication date: 11 Apr 2023
URL: https://advisories.mageia.org/MGASA-2023-0131.html
Type: security
Affected Mageia releases: 8
CVE: CVE-2023-1393

A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead
to local privilege escalation. If a client explicitly destroys the
compositor overlay window (aka COW), the Xserver would leave a dangling
pointer to that window in the CompScreen structure, which will trigger a
use-after-free later. (CVE-2023-1393)

References:
- https://bugs.mageia.org/show_bug.cgi?id=31732
- https://lists.x.org/archives/xorg-announce/2023-March/003374.html
- https://www.debian.org/security/2023/dsa-5380
- https://ubuntu.com/security/notices/USN-5986-1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/CB62PUAZRE2ZK6PDX6OZ2WSYXDJGBGTS/
- https://access.redhat.com/errata/RHSA-2023:1592
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SW2NRC3V53PIBXFPFBVWCOM2MDDILWQS/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1393

SRPMS:
- 8/core/tigervnc-1.11.0-4.3.mga8
- 8/core/x11-server-1.20.14-4.3.mga8