[USN-6555-1] X.Org X Server vulnerabilities

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmV5zK8ACgkQZWnYVadE
vpPAsRAAoVgwK0DW9FomxUODQX6RE1Uj2H+IPXxtDgcpN6sxEWE9lp9+YiM8uuNe
Mg/CBEcSBnDGor53Ww0cP6TIpS9MREkWpVK62NGqyff8//dN8iTmeXH07b8d1gD1
N1cAvZom5zZ12WXjFVjWhWtzmtPtWct+I6fFWZ9xoHeV11nr4l/N5zPYEHGeTtKE
5IRZ0a4KyTMnl8y90DLlNrrlytKYhN1V2dLJ1HT4tXr/Ob9tcIxP0Ulmy/DGcwws
6c4kqVJ3EdryC/tekK3rT1IIPWW+9rVOytLnDNXEu1zbkRNU6dRF04kRP4Fqz0eE
sCwt5MOs8P0WxV/tCRL/lynC8aYpVzuqw5+1vzXEVYNyzSV66XENWdMAuYCl+EkI
hisv0ABYIOQVTXPrDTQcgsYCm7ryHpoue899iIy44E0+yLPmqX0fdQV/uOTkIbix
AYH4p1WpZw1Tv7hTqAqLWwIywnz1Bpu0FhXw3/gLv3AWHMZ2Z24dqXQa3m03GnMI
tL6uKVVay7anQmh+XQZWDPPi1WMNyBdA4vSTx/CtDtYyjVcgMRQgK33puddkEYgC
D8oKqSbF+Lui4CvBTif2Xyfu6Dh8HF4jYBRc/NPy9Uwg62pRJsJekDKA29RfW9rh
LUlFHmYV73aoBQQA++DsA2a7OZamYxvYfl2t5sn67c+E35tPsMs=
=DVl9
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6555-1
December 13, 2023

xorg-server, xwayland vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

Several security issues were fixed in X.Org X Server.

Software Description:
- xorg-server: X.Org X11 server
- xwayland: X server for running X clients under Wayland

Details:

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled XKB
button actions. An attacker could possibly use this issue to cause the X
Server to crash, execute arbitrary code, or escalate privileges.
(CVE-2023-6377)

Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled
memory when processing the RRChangeOutputProperty and
RRChangeProviderProperty APIs. An attacker could possibly use this issue to
cause the X Server to crash, or obtain sensitive information.
(CVE-2023-6478)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
xserver-xorg-core 2:21.1.7-3ubuntu2.4
xwayland 2:23.2.0-1ubuntu0.3

Ubuntu 23.04:
xserver-xorg-core 2:21.1.7-1ubuntu3.4
xwayland 2:22.1.8-1ubuntu1.3

Ubuntu 22.04 LTS:
xserver-xorg-core 2:21.1.4-2ubuntu1.7~22.04.5
xwayland 2:22.1.1-1ubuntu0.9

Ubuntu 20.04 LTS:
xserver-xorg-core 2:1.20.13-1ubuntu1~20.04.12
xwayland 2:1.20.13-1ubuntu1~20.04.12

After a standard system update you need to reboot your computer to make all
the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6555-1
CVE-2023-6377, CVE-2023-6478

Package Information:
https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.7-3ubuntu2.4
https://launchpad.net/ubuntu/+source/xwayland/2:23.2.0-1ubuntu0.3
https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.7-1ubuntu3.4
https://launchpad.net/ubuntu/+source/xwayland/2:22.1.8-1ubuntu1.3
https://launchpad.net/ubuntu/+source/xorg-server/2:21.1.4-2ubuntu1.7~22.04.5
https://launchpad.net/ubuntu/+source/xwayland/2:22.1.1-1ubuntu0.9
https://launchpad.net/ubuntu/+source/xorg-server/2:1.20.13-1ubuntu1~20.04.12