CVE-2022-3553 — X.org Server xquartz X11Controller.m denial of service

Back Back to CVE browser

MEDIUM

X.org Server xquartz X11Controller.m denial of service

Published Oct 17, 2022

6.5

MEDIUM

CVSS 3.1

EPSS 1.35%

Description

A vulnerability, which was classified as problematic, was found in X.org Server. This affects an unknown part of the file hw/xquartz/X11Controller.m of the component xquartz. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier VDB-211053 was assigned to this vulnerability.

Affected products

Vendor X.org Product Server Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

X.org

Server

n/a

Version	Status	Constraints

Red Hat Enterprise Linux 6

xorg-x11-server

Out of support scope
Red Hat Enterprise Linux 7

xorg-x11-server

Out of support scope
Red Hat Enterprise Linux 8

xorg-x11-server

Not affected
Red Hat Enterprise Linux 8

xorg-x11-server-Xwayland

Not affected
Red Hat Enterprise Linux 9

xorg-x11-server

Not affected
Red Hat Enterprise Linux 9

xorg-x11-server-Xwayland

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	xorg-x11-server	Out of support scope	n/a
Red Hat Enterprise Linux 7	xorg-x11-server	Out of support scope	n/a
Red Hat Enterprise Linux 8	xorg-x11-server	Not affected	n/a
Red Hat Enterprise Linux 8	xorg-x11-server-Xwayland	Not affected	n/a
Red Hat Enterprise Linux 9	xorg-x11-server	Not affected	n/a
Red Hat Enterprise Linux 9	xorg-x11-server-Xwayland	Not affected	n/a

Remediation

Red Hat statement

This vulnerability is present in Xquartz, the X server for MacOS. The xorg-x11-server package shipped with Red Hat Enterprise Linux is not built with Xquartz support, therefore Red Hat Enterprise Linux is not affected by this issue.

Metrics

1.35% 0.01349

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.01349

Score over time

2022–2026

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (13 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	1.35% (0.01349)	70.52th	v5 (v2026.06.15)
Jun 15, 2026	1.25% (0.01249)	65.38th	v5 (v2026.06.15)
Mar 17, 2025	0.08% (0.00084)	22.17th	v4 (v2025.03.14)
Dec 12, 2024	0.19% (0.00188)	57.49th	v3 (v2023.03.01)
Jun 7, 2024	0.19% (0.00188)	56.13th	v3 (v2023.03.01)
May 24, 2024	0.16% (0.00160)	52.59th	v3 (v2023.03.01)
May 9, 2024	0.15% (0.00152)	51.25th	v3 (v2023.03.01)
Oct 24, 2023	0.14% (0.00145)	50.17th	v3 (v2023.03.01)
Sep 17, 2023	0.07% (0.00073)	30.23th	v3 (v2023.03.01)
May 30, 2023	0.06% (0.00061)	23.90th	v3 (v2023.03.01)
Mar 7, 2023	0.04% (0.00044)	10.69th	v3 (v2023.03.01)
Mar 6, 2023	0.89% (0.00885)	27.89th	v2 (v2022.01.01)
Oct 18, 2022	0.89% (0.00885)	26.63th	v2 (v2022.01.01)

Weaknesses (1)

CWE-404

Improper Resource Shutdown or Release

References (7)

https://access.redhat.com/security/cve/CVE-2022-3553
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2140706
Issue Tracking
https://cgit.freedesktop.org/xorg/xserver/commit/?id=dfd057996b26420309c324ec844a5ba6dd07eda3
Mailing ListPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3553
https://security.gentoo.org/glsa/202305-30
vendor-advisory
https://vuldb.com/?id.211053
Third Party AdvisoryVDB Entry
https://www.cve.org/CVERecord?id=CVE-2022-3553

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-3553		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2140706		Issue Tracking
https://cgit.freedesktop.org/xorg/xserver/commit/?id=dfd057996b26420309c324ec844a5ba6dd07eda3		Mailing ListPatchVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-3553
https://security.gentoo.org/glsa/202305-30		vendor-advisory
https://vuldb.com/?id.211053		Third Party AdvisoryVDB Entry
https://www.cve.org/CVERecord?id=CVE-2022-3553