A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
Configuration 5 (hide)
| AND |
|
History
16 Sep 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
22 May 2024, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Apr 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
31 Jan 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Jan 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
11 Jan 2024, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
02 Jan 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
25 Dec 2023, 04:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Dec 2023, 17:18
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
|
| References | () https://www.debian.org/security/2023/dsa-5576 - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2023/12/13/1 - Mailing List | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2253291 - Issue Tracking | |
| References | () https://lists.debian.org/debian-lts-announce/2023/12/msg00013.html - Mailing List | |
| References | () https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd - Patch | |
| References | () https://access.redhat.com/security/cve/CVE-2023-6377 - Vendor Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/ - Vendor Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html - Mailing List | |
| References | () https://lists.x.org/archives/xorg-announce/2023-December/003435.html - Mailing List | |
| CPE | cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:a:tigervnc:tigervnc:-:*:*:*:*:*:*:* |
|
| CWE | CWE-125 | |
| First Time |
X.org
X.org x Server X.org xwayland Redhat enterprise Linux Tigervnc Tigervnc tigervnc Redhat enterprise Linux Eus Redhat Debian debian Linux Debian |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
17 Dec 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-13 07:15
Updated : 2024-09-16 16:15
NVD link : CVE-2023-6377
Mitre link : CVE-2023-6377
CVE.ORG link : CVE-2023-6377
JSON object : View
Products Affected
x.org
- x_server
- xwayland
redhat
- enterprise_linux
- enterprise_linux_eus
debian
- debian_linux
tigervnc
- tigervnc
CWE
CWE-125
Out-of-bounds Read