CVE-2023-5367

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-5367
A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:6802 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6808 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7373 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7388 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7405 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7428 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7436 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7526 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7533 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0010 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0128 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2169
https://access.redhat.com/errata/RHSA-2024:2170
https://access.redhat.com/errata/RHSA-2024:2995
https://access.redhat.com/errata/RHSA-2024:2996
https://access.redhat.com/security/cve/CVE-2023-5367 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2243091 Issue Tracking Third Party Advisory
https://lists.x.org/archives/xorg-announce/2023-October/003430.html Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
History

16 Sep 2024, 16:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://security.gentoo.org/glsa/202401-30', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://security.netapp.com/advisory/ntap-20231130-0004/', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://www.debian.org/security/2023/dsa-5534', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}

22 May 2024, 17:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:2995 -
  • () https://access.redhat.com/errata/RHSA-2024:2996 -

30 Apr 2024, 14:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:2169 -
  • () https://access.redhat.com/errata/RHSA-2024:2170 -

16 Feb 2024, 15:33

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2023:7405 - () https://access.redhat.com/errata/RHSA-2023:7405 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7436 - () https://access.redhat.com/errata/RHSA-2023:7436 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6802 - () https://access.redhat.com/errata/RHSA-2023:6802 - Third Party Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/ - Mailing List, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6808 - () https://access.redhat.com/errata/RHSA-2023:6808 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20231130-0004/ - () https://security.netapp.com/advisory/ntap-20231130-0004/ - Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/ - Mailing List, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7373 - () https://access.redhat.com/errata/RHSA-2023:7373 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7533 - () https://access.redhat.com/errata/RHSA-2023:7533 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7526 - () https://access.redhat.com/errata/RHSA-2023:7526 - Third Party Advisory
References () https://security.gentoo.org/glsa/202401-30 - () https://security.gentoo.org/glsa/202401-30 - Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/ - Mailing List, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0010 - () https://access.redhat.com/errata/RHSA-2024:0010 - Third Party Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/ - Mailing List, Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0128 - () https://access.redhat.com/errata/RHSA-2024:0128 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7428 - () https://access.redhat.com/errata/RHSA-2023:7428 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7388 - () https://access.redhat.com/errata/RHSA-2023:7388 - Third Party Advisory
First Time Redhat enterprise Linux Server
Redhat enterprise Linux For Scientific Computing
Redhat enterprise Linux Workstation
Redhat enterprise Linux For Power Big Endian
Redhat enterprise Linux For Ibm Z Systems
Redhat enterprise Linux Desktop
Redhat enterprise Linux For Power Little Endian
CPE cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*

31 Jan 2024, 13:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202401-30 -

10 Jan 2024, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0128 -

02 Jan 2024, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0010 -

30 Nov 2023, 22:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20231130-0004/ -

28 Nov 2023, 18:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7533 -
  • () https://access.redhat.com/errata/RHSA-2023:7526 -

21 Nov 2023, 17:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7405 -
  • () https://access.redhat.com/errata/RHSA-2023:7388 -
  • () https://access.redhat.com/errata/RHSA-2023:7428 -
  • () https://access.redhat.com/errata/RHSA-2023:7373 -
  • () https://access.redhat.com/errata/RHSA-2023:7436 -

18 Nov 2023, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/ -

17 Nov 2023, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/ -

13 Nov 2023, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/ -

10 Nov 2023, 02:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/ -

08 Nov 2023, 14:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:6808 -
  • () https://access.redhat.com/errata/RHSA-2023:6802 -

06 Nov 2023, 03:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/ -

03 Nov 2023, 23:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/ -

02 Nov 2023, 17:21

Type Values Removed Values Added
CWE CWE-787
References (MISC) https://www.debian.org/security/2023/dsa-5534 - (MISC) https://www.debian.org/security/2023/dsa-5534 - Third Party Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/ - Mailing List
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2243091 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2243091 - Issue Tracking, Third Party Advisory
References (MISC) https://lists.x.org/archives/xorg-announce/2023-October/003430.html - (MISC) https://lists.x.org/archives/xorg-announce/2023-October/003430.html - Patch, Vendor Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/ - Mailing List
References (MISC) https://access.redhat.com/security/cve/CVE-2023-5367 - (MISC) https://access.redhat.com/security/cve/CVE-2023-5367 - Third Party Advisory
First Time X.org x Server
Fedoraproject fedora
Debian debian Linux
X.org
Redhat enterprise Linux
X.org xwayland
Redhat
Debian
Fedoraproject
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

29 Oct 2023, 04:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/ -
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/ -

25 Oct 2023, 23:15

Type Values Removed Values Added
References
  • (MISC) https://www.debian.org/security/2023/dsa-5534 -

25 Oct 2023, 20:31

Type Values Removed Values Added
New CVE
Information

Published : 2023-10-25 20:15

Updated : 2024-09-16 16:15

NVD link : CVE-2023-5367

Mitre link : CVE-2023-5367

CVE.ORG link : CVE-2023-5367

JSON object : View

Products Affected

redhat

  • enterprise_linux
  • enterprise_linux_for_scientific_computing
  • enterprise_linux_for_power_little_endian
  • enterprise_linux_for_power_big_endian
  • enterprise_linux_desktop
  • enterprise_linux_server
  • enterprise_linux_workstation
  • enterprise_linux_for_ibm_z_systems

debian

  • debian_linux

x.org

  • x_server
  • xwayland

fedoraproject

  • fedora
CWE
CWE-787

Out-of-bounds Write