Bug 2140706 (CVE-2022-3553)

Summary:	CVE-2022-3553 xorg-x11-server: DoS in xquartz when editing the Application menu due to mutaing immutable arrays
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adudiak, ajax, jwong, kaycoth, kshier, ofourdan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2140718, 2140719
Bug Blocks:	2135594

Description Guilherme de Almeida Suckevicz 2022-11-07 17:10:16 UTC

A vulnerability, which was classified as problematic, was found in X.org Server. This affects an unknown part of the file hw/xquartz/X11Controller.m of the component xquartz. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier VDB-211053 was assigned to this vulnerability.

Reference:
https://vuldb.com/?id.211053

Upstream patch:
https://cgit.freedesktop.org/xorg/xserver/commit/?id=dfd057996b26420309c324ec844a5ba6dd07eda3

Comment 2 Guilherme de Almeida Suckevicz 2022-11-07 17:45:35 UTC

Created xorg-x11-server tracking bugs for this issue:

Affects: fedora-all [bug 2140718]


Created xorg-x11-server-Xwayland tracking bugs for this issue:

Affects: fedora-all [bug 2140719]