Log in Start free

Vulnerability · Published Oct 17, 2022 · Assigned by VulDB

CVE-2022-3550X.org Server xkb.c _GetCountedString buffer overflow

Medium 5.5

In plain English

A medium-severity memory corruption in Server from X.org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)2.0%top 18.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8xorg-x11-server-Xdmx1.20.11-15.el8ALSA-2023:2806
AlmaLinux:9xorg-x11-server-Xdmx1.20.11-17.el9ALSA-2023:2248
AlmaLinux:8xorg-x11-server-Xephyr1.20.11-15.el8ALSA-2023:2806
AlmaLinux:9xorg-x11-server-Xephyr1.20.11-17.el9ALSA-2023:2248
AlmaLinux:8xorg-x11-server-Xnest1.20.11-15.el8ALSA-2023:2806
AlmaLinux:9xorg-x11-server-Xnest1.20.11-17.el9ALSA-2023:2248
AlmaLinux:8xorg-x11-server-Xorg1.20.11-15.el8ALSA-2023:2806
AlmaLinux:9xorg-x11-server-Xorg1.20.11-17.el9ALSA-2023:2248
AlmaLinux:8xorg-x11-server-Xvfb1.20.11-15.el8ALSA-2023:2806
AlmaLinux:9xorg-x11-server-Xvfb1.20.11-17.el9ALSA-2023:2248
AlmaLinux:8xorg-x11-server-Xwayland21.1.3-10.el8ALSA-2023:2805
AlmaLinux:9xorg-x11-server-Xwayland21.1.3-7.el9ALSA-2023:2249
AlmaLinux:8xorg-x11-server-common1.20.11-15.el8ALSA-2023:2806
AlmaLinux:9xorg-x11-server-common1.20.11-17.el9ALSA-2023:2248
AlmaLinux:8xorg-x11-server-devel1.20.11-15.el8ALSA-2023:2806
AlmaLinux:9xorg-x11-server-devel1.20.11-17.el9ALSA-2023:2248
AlmaLinux:8xorg-x11-server-source1.20.11-15.el8ALSA-2023:2806
AlmaLinux:9xorg-x11-server-source1.20.11-17.el9ALSA-2023:2248
Debian:12xorg-server2:21.1.4-3DEBIAN-CVE-2022-3550
Debian:13xorg-server2:21.1.4-3DEBIAN-CVE-2022-3550
Debian:14xorg-server2:21.1.4-3DEBIAN-CVE-2022-3550
Debian:12xwayland2:22.1.5-1DEBIAN-CVE-2022-3550
Debian:13xwayland2:22.1.5-1DEBIAN-CVE-2022-3550
Debian:14xwayland2:22.1.5-1DEBIAN-CVE-2022-3550
Ubuntu:22.04:LTSxorg-server2:21.1.3-2ubuntu2.3USN-5740-1
Ubuntu:22.04:LTSxorg-server2:21.1.3-2ubuntu2.3UBUNTU-CVE-2022-3550
Ubuntu:22.04:LTSxwayland2:22.1.1-1ubuntu0.3UBUNTU-CVE-2022-3550
Ubuntu:22.04:LTSxwayland2:22.1.1-1ubuntu0.3USN-5740-1

Affected products (as reported)

VendorProductVersions
X.org Server n/a

Weakness: CWE-119 · Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

References