Out-of-bounds Write Affecting xwayland package, versions <23.2.4-r0
Threat Intelligence
EPSS
0.04% (6th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ALPINE320-XWAYLAND-7015415
- published 23 May 2024
- disclosed 18 Jan 2024
Introduced: 18 Jan 2024
CVE-2024-0409 Open this link in a new tabHow to fix?
Upgrade Alpine:3.20 xwayland to version 23.2.4-r0 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream xwayland package and not the xwayland package as distributed by Alpine.
See How to fix? for Alpine:3.20 relevant fixed versions and status.
A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
References
- https://access.redhat.com/errata/RHSA-2024:0320
- https://access.redhat.com/security/cve/CVE-2024-0409
- https://bugzilla.redhat.com/show_bug.cgi?id=2257690
- https://lists.debian.org/debian-lts-announce/2024/01/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5J4H7CH565ALSZZYKOJFYDA5KFLG6NUK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EJBMCWQ54R6ZL3MYU2D2JBW6JMZL7BQW/
- https://security.gentoo.org/glsa/202401-30
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZ75X54CN4IFYMIV7OK3JVZ57FHQIGIC/
- https://security.netapp.com/advisory/ntap-20240307-0006/
- https://access.redhat.com/errata/RHSA-2024:2169
- https://access.redhat.com/errata/RHSA-2024:2170
- https://access.redhat.com/errata/RHSA-2024:2995
- https://access.redhat.com/errata/RHSA-2024:2996
CVSS Scores
version 3.1