Amazon Linux 1 (EOL) Security Advisory: ALAS-2023-1746
Advisory Released Date: 2023-05-16
Advisory Updated Date: 2023-05-23
Severity:
Important
Issue Overview:
A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions. (CVE-2023-0494)
Affected Packages:
tigervnc
Issue Correction:
Run yum update tigervnc or yum update --advisory ALAS-2023-1746 to update your system.
New Packages:
i686:
tigervnc-debuginfo-1.8.0-21.35.amzn1.i686
tigervnc-1.8.0-21.35.amzn1.i686
tigervnc-server-module-1.8.0-21.35.amzn1.i686
tigervnc-server-1.8.0-21.35.amzn1.i686
src:
tigervnc-1.8.0-21.35.amzn1.src
x86_64:
tigervnc-debuginfo-1.8.0-21.35.amzn1.x86_64
tigervnc-server-1.8.0-21.35.amzn1.x86_64
tigervnc-server-module-1.8.0-21.35.amzn1.x86_64
tigervnc-1.8.0-21.35.amzn1.x86_64