[USN-6453-2] X.Org X Server vulnerabilities

[Leonidas S. Barbosa]

==========================================================================
Ubuntu Security Notice USN-6453-2
October 31, 2023

xorg-server vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
- Ubuntu 14.04 LTS (Available with Ubuntu Pro)

Summary:

Several security issues were fixed in X.Org X Server, xwayland.

Software Description:
- xorg-server: X.Org X11 server

Details:

USN-6453-1 fixed several vulnerabilities in X.Org. This update provides
the corresponding update for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS.

Original advisory details:

 Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
 prepending values to certain properties. An attacker could possibly use
 this issue to cause the X Server to crash, execute arbitrary code, or
 escalate privileges. (CVE-2023-5367)

 Sri discovered that the X.Org X Server incorrectly handled detroying
 windows in certain legacy multi-screen setups. An attacker could possibly
 use this issue to cause the X Server to crash, execute arbitrary code, or
 escalate privileges. (CVE-2023-5380)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS (Available with Ubuntu Pro):
  xserver-xorg-core               2:1.19.6-1ubuntu4.15+esm1
  xwayland                        2:1.19.6-1ubuntu4.15+esm1

Ubuntu 16.04 LTS (Available with Ubuntu Pro):
  xserver-xorg-core               2:1.18.4-0ubuntu0.12+esm6
  xwayland                        2:1.18.4-0ubuntu0.12+esm6

Ubuntu 14.04 LTS (Available with Ubuntu Pro):
  xserver-xorg-core               2:1.15.1-0ubuntu2.11+esm8

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-6453-2
  https://ubuntu.com/security/notices/USN-6453-1
  CVE-2023-5367, CVE-2023-5380

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20231031/b8566de4/attachment.sig>