{"id":"CVE-2022-3554","aliases":["EUVD-2022-42920","GHSA-3mf8-prv8-p497","MGASA-2022-0438","OESA-2022-2022","SUSE-SU-2022:3986-1","SUSE-SU-2022:3987-1","UBUNTU-CVE-2022-3554","openSUSE-SU-2024:12424-1"],"status":"rejected","title":"A vulnerability has been found in X.org libX11 and classified as problematic. This vulnerability...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-401","CWE-404"],"published":"2022-10-17T13:15:00Z","modified":"2026-08-18T01:17:21Z","affected":[{"source":"osv","ecosystem":"Mageia:8","package":"libx11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.0-1.3.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.9-6.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.9-6.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.2-4.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-150000.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-150000.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-150000.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-150000.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-150000.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-150000.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-150000.3.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-12.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-12.24.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"libX11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.2-12.24.1"}]}],"bundled":2}],"references":[{"url":"https://advisories.mageia.org/CVE-2022-3554.html"},{"url":"https://www.suse.com/security/cve/CVE-2022-3554.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3554","tags":["advisory"]},{"url":"https://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=1d11822601fd24a396b354fa616b04ed3df8b4ef"},{"url":"https://vuldb.com/?id.211054"},{"url":"https://github.com/advisories/GHSA-3mf8-prv8-p497"},{"url":"https://advisories.mageia.org/MGASA-2022-0438.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31137","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-November/012923.html","tags":["web"]},{"url":"https://lists.x.org/archives/xorg-announce/2022-November/003253.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TPCKHK5VITSWJVYMQDZ642ZYBWJACES3/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2022","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3555","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223986-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204422","tags":["report"]},{"url":"https://bugzilla.suse.com/1204425","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3555","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223987-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-3554","tags":["report"]},{"url":"https://gitlab.freedesktop.org/xorg/lib/libx11/commit/1d11822601fd24a396b354fa616b04ed3df8b4ef","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-3554","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-3554","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","modified":"2022-11-02T00:00:00Z","updated_at":"2026-11-02T14:34:32.843656Z"}],"euvd":[{"id":"EUVD-2022-42920","description":"A vulnerability has been found in X.org libX11 and classified as problematic. This vulnerability affects the function _XimRegisterIMInstantiateCallback of the file modules/im/ximcp/imsClbk.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211054 is the identifier assigned to this vulnerability.","status":"published","published":"2022-10-17T19:00:30Z","modified":"2022-10-19T19:00:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:51:06.07073Z"}],"ghsa":[{"id":"GHSA-3mf8-prv8-p497","title":"A vulnerability has been found in X.org libX11 and classified as problematic. This vulnerability...","description":"A vulnerability has been found in X.org libX11 and classified as problematic. This vulnerability affects the function _XimRegisterIMInstantiateCallback of the file modules/im/ximcp/imsClbk.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211054 is the identifier assigned to this vulnerability.","status":"published","published":"2022-10-17T19:00:30Z","modified":"2023-01-31T05:08:42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-401","CWE-404"],"updated_at":"2026-11-02T14:49:26.621577Z"}],"nvd":[{"id":"CVE-2022-3554","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"rejected","published":"2022-10-17T13:15:10.563Z","modified":"2023-11-07T03:51:26.017Z","updated_at":"2026-11-02T14:07:30.6869Z"}],"osv":[{"id":"OESA-2022-2022","title":"libX11 security update","description":"The libX11-devel package contains libraries and header files for libX11.\r\n\r\nSecurity Fix(es):\r\n\r\nA vulnerability was found in X.org libX11 and classified as problematic. This issue affects the function _XFreeX11XCBStructure of the file xcb_disp.c. The manipulation of the argument dpy leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211055.(CVE-2022-3555)\r\n\r\nA vulnerability has been found in X.org libX11 and classified as problematic. This vulnerability affects the function _XimRegisterIMInstantiateCallback of the file modules/im/ximcp/imsClbk.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. VDB-211054 is the identifier assigned to this vulnerability.(CVE-2022-3554)","status":"published","published":"2022-10-28T11:05:20Z","modified":"2026-08-18T01:17:21.003956187Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2022-3554","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.","status":"withdrawn","published":"2022-10-17T13:15:00Z","modified":"2025-07-08T14:32:24.746123Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"MGASA-2022-0438","title":"Updated libx11 packages fix security vulnerability","description":"Memory leak in XRegisterIMInstantiateCallback(). (CVE-2022-3554)\nMemory leak in _XFreeX11XCBStructure(). (CVE-2022-3555)\n","status":"published","published":"2022-11-24T22:21:24Z","modified":"2026-04-16T04:44:25.829576127Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:12424-1","title":"libX11-6-1.8.1-3.1 on GA media","description":"These are all security issues fixed in the libX11-6-1.8.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:31:13.849458Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2022:3986-1","title":"Security update for libX11","description":"This update for libX11 fixes the following issues:\n\n  - CVE-2022-3554: Fixed memory leak in XRegisterIMInstantiateCallback() (bsc#1204422).\n  - CVE-2022-3555: Fixed memory leak in _XFreeX11XCBStructure() (bsc#1204425).\n","status":"published","published":"2022-11-15T11:58:01Z","modified":"2026-02-04T03:35:05.031781Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3987-1","title":"Security update for libX11","description":"This update for libX11 fixes the following issues:\n\n  - CVE-2022-3554: Fixed memory leak in XRegisterIMInstantiateCallback() (bsc#1204422).\n  - CVE-2022-3555: Fixed memory leak in _XFreeX11XCBStructure() (bsc#1204425). \n","status":"published","published":"2022-11-15T11:58:39Z","modified":"2026-02-04T02:40:10.751403Z","updated_at":"2026-11-02T15:53:51.440565Z"}]}}