Out-of-bounds Write Affecting xorg-x11-server-source package, versions <0:1.20.11-24.el9


Severity

Recommended
medium

Based on Oracle Linux security rating.

Threat Intelligence

Exploit Maturity
Not Defined
EPSS
1.61% (88th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE9-XORGX11SERVERSOURCE-6813203
  • published8 May 2024
  • disclosed18 Jan 2024

Introduced: 18 Jan 2024

CVE-2023-6816  (opens in a new tab)
CWE-787  (opens in a new tab)

How to fix?

Upgrade Oracle:9 xorg-x11-server-source to version 0:1.20.11-24.el9 or higher.
This issue was patched in ELSA-2024-2169.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xorg-x11-server-source package and not the xorg-x11-server-source package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

CVSS Scores

version 3.1