TRUMPF: Multiple products prone to X.Org server vulnerabilities
TruControl laser control software from versions 1.60.0 to 3.40.0 use a vulnerable X.Org server versions. The affected X.Org vulnerability is not validating the request length properly for the handler 'ProcXkbSetGeometry'. An authenticated Attacker could craft a request which could lead to memory out-of bounds write.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-2320US | high7.8 | — | ||
A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user… | ||||
| CVE-2022-2319US | high7.8 | — | ||
A flaw was found in the Xorg-x11-server. An out-of-bounds access issue can occur in the ProcXkbSetGeometry function due to improper validation of the request length. | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- Mitigation
Securing the access to the production network. Please contact your service partner (service.tls@trumpf.com) for instructions on how to get automatically informed for the new major release 3.42.0 of the new TruControl software version.
- Mitigation
Securing the access to the production network. Please contact your service partner (service.tls@trumpf.com) for instructions on how to get automatically informed for the new major release 3.42.0 of the new TruControl software version.
- Fixed
Retrieve instructions on how to deactivate the ssh access or activate the firewall on port 22 (SSH) of your laser.
- Fixed
Retrieve instructions on how to deactivate the ssh access or activate the firewall on port 22 (SSH) of your laser.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan