<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
  <DocumentTitle xml:lang="en">Security update for xorg-x11-server</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2022:4481-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-12-14T11:44:00Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-12-14T11:44:00Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-12-14T11:44:00Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for xorg-x11-server</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for xorg-x11-server fixes the following issues:

- CVE-2022-46340: Server XTestSwapFakeInput stack overflow (bsc#1205874)
- CVE-2022-46341: Server XIPassiveUngrabDevice out-of-bounds access (bsc#1205877)
- CVE-2022-46342: Server XvdiSelectVideoNotify use-after-free (bsc#1205879)
- CVE-2022-46343: Server ScreenSaverSetAttributes use-after-free (bsc#1205878)
- CVE-2022-46344: Server XIChangeProperty out-of-bounds access (bsc#1205876)
- CVE-2022-4283: Reset the radio_groups pointer to NULL after freeing it (bsc#1206017)
- Xi: return an error from XI property changes if verification failed (bsc#1205875)
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2022-4481,SUSE-SLE-Product-HPC-15-SP1-ESPOS-2022-4481,SUSE-SLE-Product-HPC-15-SP1-LTSS-2022-4481,SUSE-SLE-Product-SLES-15-SP1-BCL-2022-4481,SUSE-SLE-Product-SLES-15-SP1-LTSS-2022-4481,SUSE-SLE-Product-SLES_SAP-15-SP1-2022-4481,SUSE-Storage-6-2022-4481</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20224481-1/</URL>
      <Description>Link for SUSE-SU-2022:4481-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2022-December/013246.html</URL>
      <Description>E-Mail link for SUSE-SU-2022:4481-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1205874</URL>
      <Description>SUSE Bug 1205874</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1205875</URL>
      <Description>SUSE Bug 1205875</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1205876</URL>
      <Description>SUSE Bug 1205876</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1205877</URL>
      <Description>SUSE Bug 1205877</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1205878</URL>
      <Description>SUSE Bug 1205878</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1205879</URL>
      <Description>SUSE Bug 1205879</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1206017</URL>
      <Description>SUSE Bug 1206017</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-4283/</URL>
      <Description>SUSE CVE CVE-2022-4283 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-46340/</URL>
      <Description>SUSE CVE CVE-2022-46340 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-46341/</URL>
      <Description>SUSE CVE CVE-2022-46341 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-46342/</URL>
      <Description>SUSE CVE CVE-2022-46342 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-46343/</URL>
      <Description>SUSE CVE CVE-2022-46343 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-46344/</URL>
      <Description>SUSE CVE CVE-2022-46344 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
    <Branch Type="Product Family" Name="SUSE Enterprise Storage 6">
      <Branch Type="Product Name" Name="SUSE Enterprise Storage 6">
        <FullProductName ProductID="SUSE Enterprise Storage 6" CPE="cpe:/o:suse:ses:6">SUSE Enterprise Storage 6</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS">
        <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS" CPE="cpe:/o:suse:sle_hpc-espos:15:sp1">SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS" CPE="cpe:/o:suse:sle_hpc-ltss:15:sp1">SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 15 SP1-BCL">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 15 SP1-BCL">
        <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP1-BCL" CPE="cpe:/o:suse:sles_bcl:15:sp1">SUSE Linux Enterprise Server 15 SP1-BCL</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server 15 SP1-LTSS">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server 15 SP1-LTSS">
        <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP1-LTSS" CPE="cpe:/o:suse:sles-ltss:15:sp1">SUSE Linux Enterprise Server 15 SP1-LTSS</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Server for SAP Applications 15 SP1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Server for SAP Applications 15 SP1">
        <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15 SP1" CPE="cpe:/o:suse:sles_sap:15:sp1">SUSE Linux Enterprise Server for SAP Applications 15 SP1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="xorg-x11-server-1.20.3-150100.14.5.33.1">
      <FullProductName ProductID="xorg-x11-server-1.20.3-150100.14.5.33.1">xorg-x11-server-1.20.3-150100.14.5.33.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xorg-x11-server-extra-1.20.3-150100.14.5.33.1">
      <FullProductName ProductID="xorg-x11-server-extra-1.20.3-150100.14.5.33.1">xorg-x11-server-extra-1.20.3-150100.14.5.33.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xorg-x11-server-sdk-1.20.3-150100.14.5.33.1">
      <FullProductName ProductID="xorg-x11-server-sdk-1.20.3-150100.14.5.33.1">xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xorg-x11-server-source-1.20.3-150100.14.5.33.1">
      <FullProductName ProductID="xorg-x11-server-source-1.20.3-150100.14.5.33.1">xorg-x11-server-source-1.20.3-150100.14.5.33.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="xorg-x11-server-wayland-1.20.3-150100.14.5.33.1">
      <FullProductName ProductID="xorg-x11-server-wayland-1.20.3-150100.14.5.33.1">xorg-x11-server-wayland-1.20.3-150100.14.5.33.1</FullProductName>
    </Branch>
    <Relationship ProductReference="xorg-x11-server-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 6">
      <FullProductName ProductID="SUSE Enterprise Storage 6:xorg-x11-server-1.20.3-150100.14.5.33.1">xorg-x11-server-1.20.3-150100.14.5.33.1 as a component of SUSE Enterprise Storage 6</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-extra-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 6">
      <FullProductName ProductID="SUSE Enterprise Storage 6:xorg-x11-server-extra-1.20.3-150100.14.5.33.1">xorg-x11-server-extra-1.20.3-150100.14.5.33.1 as a component of SUSE Enterprise Storage 6</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-sdk-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Enterprise Storage 6">
      <FullProductName ProductID="SUSE Enterprise Storage 6:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1">xorg-x11-server-sdk-1.20.3-150100.14.5.33.1 as a component of SUSE Enterprise Storage 6</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-1.20.3-150100.14.5.33.1">xorg-x11-server-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-extra-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1">xorg-x11-server-extra-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-sdk-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1">xorg-x11-server-sdk-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1">xorg-x11-server-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-extra-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1">xorg-x11-server-extra-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-sdk-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1">xorg-x11-server-sdk-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP1-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-1.20.3-150100.14.5.33.1">xorg-x11-server-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-extra-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP1-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-extra-1.20.3-150100.14.5.33.1">xorg-x11-server-extra-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-sdk-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP1-BCL">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1">xorg-x11-server-sdk-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-BCL</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP1-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1">xorg-x11-server-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-extra-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP1-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1">xorg-x11-server-extra-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-sdk-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server 15 SP1-LTSS">
      <FullProductName ProductID="SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1">xorg-x11-server-sdk-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise Server 15 SP1-LTSS</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-1.20.3-150100.14.5.33.1">xorg-x11-server-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-extra-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-extra-1.20.3-150100.14.5.33.1">xorg-x11-server-extra-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1</FullProductName>
    </Relationship>
    <Relationship ProductReference="xorg-x11-server-sdk-1.20.3-150100.14.5.33.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Server for SAP Applications 15 SP1">
      <FullProductName ProductID="SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1">xorg-x11-server-sdk-1.20.3-150100.14.5.33.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1</FullProductName>
    </Relationship>
  </ProductTree>
  <Vulnerability xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.</Note>
    </Notes>
    <CVE>CVE-2022-4283</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20224481-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-4283.html</URL>
        <Description>CVE-2022-4283</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1206017</URL>
        <Description>SUSE Bug 1206017</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1208344</URL>
        <Description>SUSE Bug 1208344</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1208653</URL>
        <Description>SUSE Bug 1208653</Description>
      </Reference>
    </References>
  </Vulnerability>
  <Vulnerability xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. This issue does not affect systems where client and server use the same byte order.</Note>
    </Notes>
    <CVE>CVE-2022-46340</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20224481-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-46340.html</URL>
        <Description>CVE-2022-46340</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1205874</URL>
        <Description>SUSE Bug 1205874</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1206822</URL>
        <Description>SUSE Bug 1206822</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1208344</URL>
        <Description>SUSE Bug 1208344</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1208653</URL>
        <Description>SUSE Bug 1208653</Description>
      </Reference>
    </References>
  </Vulnerability>
  <Vulnerability xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.</Note>
    </Notes>
    <CVE>CVE-2022-46341</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20224481-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-46341.html</URL>
        <Description>CVE-2022-46341</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1205877</URL>
        <Description>SUSE Bug 1205877</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1208653</URL>
        <Description>SUSE Bug 1208653</Description>
      </Reference>
    </References>
  </Vulnerability>
  <Vulnerability xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X se</Note>
    </Notes>
    <CVE>CVE-2022-46342</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20224481-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-46342.html</URL>
        <Description>CVE-2022-46342</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1205879</URL>
        <Description>SUSE Bug 1205879</Description>
      </Reference>
    </References>
  </Vulnerability>
  <Vulnerability xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.</Note>
    </Notes>
    <CVE>CVE-2022-46343</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20224481-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-46343.html</URL>
        <Description>CVE-2022-46343</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1205878</URL>
        <Description>SUSE Bug 1205878</Description>
      </Reference>
    </References>
  </Vulnerability>
  <Vulnerability xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions.</Note>
    </Notes>
    <CVE>CVE-2022-46344</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Enterprise Storage 6:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-BCL:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server 15 SP1-LTSS:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-extra-1.20.3-150100.14.5.33.1</ProductID>
        <ProductID>SUSE Linux Enterprise Server for SAP Applications 15 SP1:xorg-x11-server-sdk-1.20.3-150100.14.5.33.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20224481-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-46344.html</URL>
        <Description>CVE-2022-46344</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1205876</URL>
        <Description>SUSE Bug 1205876</Description>
      </Reference>
    </References>
  </Vulnerability>
</cvrfdoc>
