Use After Free Affecting tigervnc package, versions <0:1.12.0-9.el8_7.3
Threat Intelligence
EPSS
0.05% (18th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ALMALINUX8-TIGERVNC-5610766
- published 28 May 2023
- disclosed 7 Nov 2023
Introduced: 28 May 2023
CVE-2023-1393 Open this link in a new tabHow to fix?
Upgrade AlmaLinux:8 tigervnc to version 0:1.12.0-9.el8_7.3 or higher.
This issue was patched in ALSA-2023:1551.
NVD Description
Note: Versions mentioned in the description apply only to the upstream tigervnc package and not the tigervnc package as distributed by AlmaLinux.
See How to fix? for AlmaLinux:8 relevant fixed versions and status.
A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later.
References
- https://errata.almalinux.org/8/ALSA-2023-1551.html
- https://errata.almalinux.org/9/ALSA-2023-1592.html
- https://errata.almalinux.org/9/ALSA-2023-6340.html
- https://errata.almalinux.org/9/ALSA-2023-6341.html
- https://errata.almalinux.org/8/ALSA-2023-6916.html
- https://errata.almalinux.org/8/ALSA-2023-6917.html
- https://access.redhat.com/security/cve/CVE-2023-1393
- https://access.redhat.com/errata/RHSA-2023:1551
- https://access.redhat.com/errata/RHSA-2023:1592
- https://access.redhat.com/errata/RHSA-2023:6340
- https://access.redhat.com/errata/RHSA-2023:6341
- https://access.redhat.com/errata/RHSA-2023:6916
- https://access.redhat.com/errata/RHSA-2023:6917
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPNQYHUI63DB5FHK6EOI3Z4C6YQZGZKI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H3EVO3OQV6T4BSABWZ2TU3PY5TJTEQZ2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MEHSYYFGBN3G4RS2HJXKQ5NBMOAZ5F2F/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NOYATGGPMT3COC7ELAJW5TG2PVS3AFR2/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PSAAGI5V77FQXIT5PP4URP6BYQVCK5U5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHJMSMK7G4GPLMKIGKXIOL2RTKU5VFWE/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SW2NRC3V53PIBXFPFBVWCOM2MDDILWQS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SWFUDSBSABRHQOX6TIQ5O3SNPFTPFQQP/
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/26ef545b3502f61ca722a7a3373507e88ef64110
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BPNQYHUI63DB5FHK6EOI3Z4C6YQZGZKI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H3EVO3OQV6T4BSABWZ2TU3PY5TJTEQZ2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MEHSYYFGBN3G4RS2HJXKQ5NBMOAZ5F2F/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NOYATGGPMT3COC7ELAJW5TG2PVS3AFR2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PSAAGI5V77FQXIT5PP4URP6BYQVCK5U5/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QHJMSMK7G4GPLMKIGKXIOL2RTKU5VFWE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SW2NRC3V53PIBXFPFBVWCOM2MDDILWQS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWFUDSBSABRHQOX6TIQ5O3SNPFTPFQQP/
- https://security.gentoo.org/glsa/202305-30
- https://www.openwall.com/lists/oss-security/2023/03/29/1
CVSS Scores
version 3.1