csaf_suse - suse-su-2023:4790-1

suse-su-2023:4790-1

Vulnerability from csaf_suse

Published

2023-12-13 13:59

Modified

2023-12-13 13:59

Summary

Security update for xorg-x11-server

Notes

Title of the patch

Security update for xorg-x11-server

Description of the patch

This update for xorg-x11-server fixes the following issues: - CVE-2023-6377: Fixed out-of-bounds memory write in XKB button actions (bsc#1217765). - CVE-2023-6478: Fixed out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty (bsc#1217766).

Patchnames

SUSE-2023-4790,SUSE-SLE-SDK-12-SP5-2023-4790,SUSE-SLE-SERVER-12-SP5-2023-4790

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for xorg-x11-server",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for xorg-x11-server fixes the following issues:\n\n- CVE-2023-6377: Fixed out-of-bounds memory write in XKB button actions (bsc#1217765).\n- CVE-2023-6478: Fixed out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty (bsc#1217766).\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-2023-4790,SUSE-SLE-SDK-12-SP5-2023-4790,SUSE-SLE-SERVER-12-SP5-2023-4790",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2023_4790-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2023:4790-1",
        "url": "https://www.suse.com/support/update/announcement/2023/suse-su-20234790-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2023:4790-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017329.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1217765",
        "url": "https://bugzilla.suse.com/1217765"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1217766",
        "url": "https://bugzilla.suse.com/1217766"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-6377 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-6377/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-6478 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-6478/"
      }
    ],
    "title": "Security update for xorg-x11-server",
    "tracking": {
      "current_release_date": "2023-12-13T13:59:25Z",
      "generator": {
        "date": "2023-12-13T13:59:25Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2023:4790-1",
      "initial_release_date": "2023-12-13T13:59:25Z",
      "revision_history": [
        {
          "date": "2023-12-13T13:59:25Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-1.19.6-10.59.1.aarch64",
                "product": {
                  "name": "xorg-x11-server-1.19.6-10.59.1.aarch64",
                  "product_id": "xorg-x11-server-1.19.6-10.59.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
                "product": {
                  "name": "xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
                  "product_id": "xorg-x11-server-extra-1.19.6-10.59.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-sdk-1.19.6-10.59.1.aarch64",
                "product": {
                  "name": "xorg-x11-server-sdk-1.19.6-10.59.1.aarch64",
                  "product_id": "xorg-x11-server-sdk-1.19.6-10.59.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-source-1.19.6-10.59.1.aarch64",
                "product": {
                  "name": "xorg-x11-server-source-1.19.6-10.59.1.aarch64",
                  "product_id": "xorg-x11-server-source-1.19.6-10.59.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-1.19.6-10.59.1.i586",
                "product": {
                  "name": "xorg-x11-server-1.19.6-10.59.1.i586",
                  "product_id": "xorg-x11-server-1.19.6-10.59.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-extra-1.19.6-10.59.1.i586",
                "product": {
                  "name": "xorg-x11-server-extra-1.19.6-10.59.1.i586",
                  "product_id": "xorg-x11-server-extra-1.19.6-10.59.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-sdk-1.19.6-10.59.1.i586",
                "product": {
                  "name": "xorg-x11-server-sdk-1.19.6-10.59.1.i586",
                  "product_id": "xorg-x11-server-sdk-1.19.6-10.59.1.i586"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-source-1.19.6-10.59.1.i586",
                "product": {
                  "name": "xorg-x11-server-source-1.19.6-10.59.1.i586",
                  "product_id": "xorg-x11-server-source-1.19.6-10.59.1.i586"
                }
              }
            ],
            "category": "architecture",
            "name": "i586"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-1.19.6-10.59.1.ppc64le",
                "product": {
                  "name": "xorg-x11-server-1.19.6-10.59.1.ppc64le",
                  "product_id": "xorg-x11-server-1.19.6-10.59.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
                "product": {
                  "name": "xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
                  "product_id": "xorg-x11-server-extra-1.19.6-10.59.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le",
                "product": {
                  "name": "xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le",
                  "product_id": "xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-source-1.19.6-10.59.1.ppc64le",
                "product": {
                  "name": "xorg-x11-server-source-1.19.6-10.59.1.ppc64le",
                  "product_id": "xorg-x11-server-source-1.19.6-10.59.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-1.19.6-10.59.1.s390",
                "product": {
                  "name": "xorg-x11-server-1.19.6-10.59.1.s390",
                  "product_id": "xorg-x11-server-1.19.6-10.59.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-extra-1.19.6-10.59.1.s390",
                "product": {
                  "name": "xorg-x11-server-extra-1.19.6-10.59.1.s390",
                  "product_id": "xorg-x11-server-extra-1.19.6-10.59.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-sdk-1.19.6-10.59.1.s390",
                "product": {
                  "name": "xorg-x11-server-sdk-1.19.6-10.59.1.s390",
                  "product_id": "xorg-x11-server-sdk-1.19.6-10.59.1.s390"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-source-1.19.6-10.59.1.s390",
                "product": {
                  "name": "xorg-x11-server-source-1.19.6-10.59.1.s390",
                  "product_id": "xorg-x11-server-source-1.19.6-10.59.1.s390"
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-1.19.6-10.59.1.s390x",
                "product": {
                  "name": "xorg-x11-server-1.19.6-10.59.1.s390x",
                  "product_id": "xorg-x11-server-1.19.6-10.59.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-extra-1.19.6-10.59.1.s390x",
                "product": {
                  "name": "xorg-x11-server-extra-1.19.6-10.59.1.s390x",
                  "product_id": "xorg-x11-server-extra-1.19.6-10.59.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-sdk-1.19.6-10.59.1.s390x",
                "product": {
                  "name": "xorg-x11-server-sdk-1.19.6-10.59.1.s390x",
                  "product_id": "xorg-x11-server-sdk-1.19.6-10.59.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-source-1.19.6-10.59.1.s390x",
                "product": {
                  "name": "xorg-x11-server-source-1.19.6-10.59.1.s390x",
                  "product_id": "xorg-x11-server-source-1.19.6-10.59.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "xorg-x11-server-1.19.6-10.59.1.x86_64",
                "product": {
                  "name": "xorg-x11-server-1.19.6-10.59.1.x86_64",
                  "product_id": "xorg-x11-server-1.19.6-10.59.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
                "product": {
                  "name": "xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
                  "product_id": "xorg-x11-server-extra-1.19.6-10.59.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-sdk-1.19.6-10.59.1.x86_64",
                "product": {
                  "name": "xorg-x11-server-sdk-1.19.6-10.59.1.x86_64",
                  "product_id": "xorg-x11-server-sdk-1.19.6-10.59.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "xorg-x11-server-source-1.19.6-10.59.1.x86_64",
                "product": {
                  "name": "xorg-x11-server-source-1.19.6-10.59.1.x86_64",
                  "product_id": "xorg-x11-server-source-1.19.6-10.59.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                  "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sle-sdk:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles:12:sp5"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                "product": {
                  "name": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sles_sap:12:sp5"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-sdk-1.19.6-10.59.1.aarch64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.aarch64"
        },
        "product_reference": "xorg-x11-server-sdk-1.19.6-10.59.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le"
        },
        "product_reference": "xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-sdk-1.19.6-10.59.1.s390x as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.s390x"
        },
        "product_reference": "xorg-x11-server-sdk-1.19.6-10.59.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-sdk-1.19.6-10.59.1.x86_64 as component of SUSE Linux Enterprise Software Development Kit 12 SP5",
          "product_id": "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.x86_64"
        },
        "product_reference": "xorg-x11-server-sdk-1.19.6-10.59.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Software Development Kit 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-1.19.6-10.59.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64"
        },
        "product_reference": "xorg-x11-server-1.19.6-10.59.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-1.19.6-10.59.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le"
        },
        "product_reference": "xorg-x11-server-1.19.6-10.59.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-1.19.6-10.59.1.s390x as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x"
        },
        "product_reference": "xorg-x11-server-1.19.6-10.59.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-1.19.6-10.59.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64"
        },
        "product_reference": "xorg-x11-server-1.19.6-10.59.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-1.19.6-10.59.1.aarch64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64"
        },
        "product_reference": "xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-1.19.6-10.59.1.ppc64le as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le"
        },
        "product_reference": "xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-1.19.6-10.59.1.s390x as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x"
        },
        "product_reference": "xorg-x11-server-extra-1.19.6-10.59.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-1.19.6-10.59.1.x86_64 as component of SUSE Linux Enterprise Server 12 SP5",
          "product_id": "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64"
        },
        "product_reference": "xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-1.19.6-10.59.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64"
        },
        "product_reference": "xorg-x11-server-1.19.6-10.59.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-1.19.6-10.59.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le"
        },
        "product_reference": "xorg-x11-server-1.19.6-10.59.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-1.19.6-10.59.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x"
        },
        "product_reference": "xorg-x11-server-1.19.6-10.59.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-1.19.6-10.59.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64"
        },
        "product_reference": "xorg-x11-server-1.19.6-10.59.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-1.19.6-10.59.1.aarch64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64"
        },
        "product_reference": "xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-1.19.6-10.59.1.ppc64le as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le"
        },
        "product_reference": "xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-1.19.6-10.59.1.s390x as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x"
        },
        "product_reference": "xorg-x11-server-extra-1.19.6-10.59.1.s390x",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "xorg-x11-server-extra-1.19.6-10.59.1.x86_64 as component of SUSE Linux Enterprise Server for SAP Applications 12 SP5",
          "product_id": "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64"
        },
        "product_reference": "xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
        "relates_to_product_reference": "SUSE Linux Enterprise Server for SAP Applications 12 SP5"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-6377",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-6377"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-6377",
          "url": "https://www.suse.com/security/cve/CVE-2023-6377"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1217765 for CVE-2023-6377",
          "url": "https://bugzilla.suse.com/1217765"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1221590 for CVE-2023-6377",
          "url": "https://bugzilla.suse.com/1221590"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-12-13T13:59:25Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-6377"
    },
    {
      "cve": "CVE-2023-6478",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-6478"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
          "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
          "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.aarch64",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.s390x",
          "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-6478",
          "url": "https://www.suse.com/security/cve/CVE-2023-6478"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1217766 for CVE-2023-6478",
          "url": "https://bugzilla.suse.com/1217766"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1222096 for CVE-2023-6478",
          "url": "https://bugzilla.suse.com/1222096"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Server for SAP Applications 12 SP5:xorg-x11-server-extra-1.19.6-10.59.1.x86_64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.aarch64",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.ppc64le",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.s390x",
            "SUSE Linux Enterprise Software Development Kit 12 SP5:xorg-x11-server-sdk-1.19.6-10.59.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-12-13T13:59:25Z",
          "details": "important"
        }
      ],
      "title": "CVE-2023-6478"
    }
  ]
}

CVE-2023-6478 (GCVE-0-2023-6478)

Vulnerability from cvelistv5

Published

2023-12-13 06:27

Modified

2025-08-04 21:03

Severity ?

7.6 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

CWE

CWE-190 - Integer Overflow or Wraparound

Summary

A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.

References

URL

Tags

	https://access.redhat.com/errata/RHSA-2023:7886	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0006	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0009	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0010	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0014	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0015	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0016	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0017	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0018	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0020	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2169	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2170	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2995	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2996	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:12751	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2023-6478	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2253298	issue-tracking, x_refsource_REDHAT
	https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632
	https://lists.x.org/archives/xorg-announce/2023-December/003435.html

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION

Unaffected: 0:1.1.0-25.el6_10.13 < *
cpe:/o:redhat:rhel_els:6

Red Hat	Red Hat Enterprise Linux 7	Unaffected: 0:1.8.0-28.el7_9 < * cpe:/o:redhat:enterprise_linux:7::server cpe:/o:redhat:enterprise_linux:7::computenode cpe:/o:redhat:enterprise_linux:7::client cpe:/o:redhat:enterprise_linux:7::workstation
Red Hat	Red Hat Enterprise Linux 7	Unaffected: 0:1.20.4-25.el7_9 < * cpe:/o:redhat:enterprise_linux:7::server cpe:/o:redhat:enterprise_linux:7::computenode cpe:/o:redhat:enterprise_linux:7::client cpe:/o:redhat:enterprise_linux:7::workstation
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.13.1-2.el8_9.4 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.20.11-22.el8 < * cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:21.1.3-15.el8 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:1.9.0-15.el8_2.6 < * cpe:/a:redhat:rhel_e4s:8.2::appstream cpe:/a:redhat:rhel_tus:8.2::appstream cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	Unaffected: 0:1.9.0-15.el8_2.6 < * cpe:/a:redhat:rhel_e4s:8.2::appstream cpe:/a:redhat:rhel_tus:8.2::appstream cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	Unaffected: 0:1.9.0-15.el8_2.6 < * cpe:/a:redhat:rhel_e4s:8.2::appstream cpe:/a:redhat:rhel_tus:8.2::appstream cpe:/a:redhat:rhel_aus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.11.0-8.el8_4.5 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:1.11.0-8.el8_4.5 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:1.11.0-8.el8_4.5 < * cpe:/a:redhat:rhel_aus:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_e4s:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	Unaffected: 0:1.12.0-6.el8_6.6 < * cpe:/a:redhat:rhel_eus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:1.12.0-15.el8_8.4 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.13.1-3.el9_3.3 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.20.11-24.el9 < * cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:22.1.9-5.el9 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	Unaffected: 0:1.11.0-22.el9_0.5 < * cpe:/a:redhat:rhel_eus:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:1.12.0-14.el9_2.2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:28:21.864Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/12/13/1"
          },
          {
            "name": "RHSA-2023:7886",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:7886"
          },
          {
            "name": "RHSA-2024:0006",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0006"
          },
          {
            "name": "RHSA-2024:0009",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0009"
          },
          {
            "name": "RHSA-2024:0010",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0010"
          },
          {
            "name": "RHSA-2024:0014",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0014"
          },
          {
            "name": "RHSA-2024:0015",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0015"
          },
          {
            "name": "RHSA-2024:0016",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0016"
          },
          {
            "name": "RHSA-2024:0017",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0017"
          },
          {
            "name": "RHSA-2024:0018",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0018"
          },
          {
            "name": "RHSA-2024:0020",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0020"
          },
          {
            "name": "RHSA-2024:2169",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2169"
          },
          {
            "name": "RHSA-2024:2170",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2170"
          },
          {
            "name": "RHSA-2024:2995",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2995"
          },
          {
            "name": "RHSA-2024:2996",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2996"
          },
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2023-6478"
          },
          {
            "name": "RHBZ#2253298",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253298"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R63Z6GIWM3YUNZRCGFODUXLW3GY2HD6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PP47YXKM5ETLCYEF6473R3VFCJ6QT2S/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFHV5KCQ2SVOD4QMCPZ5HC6YL44L7YJD/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.x.org/archives/xorg-announce/2023-December/003435.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-30"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240125-0003/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5576"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.0-25.el6_10.13",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7::server",
            "cpe:/o:redhat:enterprise_linux:7::computenode",
            "cpe:/o:redhat:enterprise_linux:7::client",
            "cpe:/o:redhat:enterprise_linux:7::workstation"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.8.0-28.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7::server",
            "cpe:/o:redhat:enterprise_linux:7::computenode",
            "cpe:/o:redhat:enterprise_linux:7::client",
            "cpe:/o:redhat:enterprise_linux:7::workstation"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.4-25.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.13.1-2.el8_9.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.11-22.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:21.1.3-15.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.2::appstream",
            "cpe:/a:redhat:rhel_tus:8.2::appstream",
            "cpe:/a:redhat:rhel_aus:8.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.9.0-15.el8_2.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.2::appstream",
            "cpe:/a:redhat:rhel_tus:8.2::appstream",
            "cpe:/a:redhat:rhel_aus:8.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.9.0-15.el8_2.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.2::appstream",
            "cpe:/a:redhat:rhel_tus:8.2::appstream",
            "cpe:/a:redhat:rhel_aus:8.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.9.0-15.el8_2.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.11.0-8.el8_4.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.11.0-8.el8_4.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_e4s:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.11.0-8.el8_4.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.12.0-6.el8_6.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.12.0-15.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.13.1-3.el9_3.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.11-24.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:22.1.9-5.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.11.0-22.el9_0.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.12.0-14.el9_2.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Peter Hutterer (Red Hat)."
        }
      ],
      "datePublic": "2023-12-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-04T21:03:38.761Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2023:7886",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:7886"
        },
        {
          "name": "RHSA-2024:0006",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0006"
        },
        {
          "name": "RHSA-2024:0009",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0009"
        },
        {
          "name": "RHSA-2024:0010",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0010"
        },
        {
          "name": "RHSA-2024:0014",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0014"
        },
        {
          "name": "RHSA-2024:0015",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0015"
        },
        {
          "name": "RHSA-2024:0016",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0016"
        },
        {
          "name": "RHSA-2024:0017",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0017"
        },
        {
          "name": "RHSA-2024:0018",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0018"
        },
        {
          "name": "RHSA-2024:0020",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0020"
        },
        {
          "name": "RHSA-2024:2169",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2169"
        },
        {
          "name": "RHSA-2024:2170",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2170"
        },
        {
          "name": "RHSA-2024:2995",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2995"
        },
        {
          "name": "RHSA-2024:2996",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2996"
        },
        {
          "name": "RHSA-2025:12751",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:12751"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2023-6478"
        },
        {
          "name": "RHBZ#2253298",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253298"
        },
        {
          "url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632"
        },
        {
          "url": "https://lists.x.org/archives/xorg-announce/2023-December/003435.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-11-30T00:00:00+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2023-12-13T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_redhatCweChain": "CWE-190: Integer Overflow or Wraparound"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-6478",
    "datePublished": "2023-12-13T06:27:41.017Z",
    "dateReserved": "2023-12-04T06:40:47.239Z",
    "dateUpdated": "2025-08-04T21:03:38.761Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-6377 (GCVE-0-2023-6377)

Vulnerability from cvelistv5

Published

2023-12-13 06:27

Modified

2025-08-18 11:22

Severity ?

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-125 - Out-of-bounds Read

Summary

A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.

References

URL

Tags

	https://access.redhat.com/errata/RHSA-2023:7886	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0006	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0009	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0010	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0014	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0015	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0016	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0017	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0018	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:0020	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2169	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2170	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2995	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2024:2996	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2025:13998	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/security/cve/CVE-2023-6377	vdb-entry, x_refsource_REDHAT
	https://bugzilla.redhat.com/show_bug.cgi?id=2253291	issue-tracking, x_refsource_REDHAT
	https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd
	https://lists.x.org/archives/xorg-announce/2023-December/003435.html

Impacted products

Vendor

Product

Version

Red Hat

Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION

Unaffected: 0:1.1.0-25.el6_10.14 < *
cpe:/o:redhat:rhel_els:6

Red Hat	Red Hat Enterprise Linux 7	Unaffected: 0:1.8.0-28.el7_9 < * cpe:/o:redhat:enterprise_linux:7::server cpe:/o:redhat:enterprise_linux:7::computenode cpe:/o:redhat:enterprise_linux:7::client cpe:/o:redhat:enterprise_linux:7::workstation
Red Hat	Red Hat Enterprise Linux 7	Unaffected: 0:1.20.4-25.el7_9 < * cpe:/o:redhat:enterprise_linux:7::server cpe:/o:redhat:enterprise_linux:7::computenode cpe:/o:redhat:enterprise_linux:7::client cpe:/o:redhat:enterprise_linux:7::workstation
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.13.1-2.el8_9.4 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:1.20.11-22.el8 < * cpe:/a:redhat:enterprise_linux:8::appstream cpe:/a:redhat:enterprise_linux:8::crb
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:21.1.3-15.el8 < * cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support	Unaffected: 0:1.9.0-15.el8_2.6 < * cpe:/a:redhat:rhel_aus:8.2::appstream cpe:/a:redhat:rhel_e4s:8.2::appstream cpe:/a:redhat:rhel_tus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service	Unaffected: 0:1.9.0-15.el8_2.6 < * cpe:/a:redhat:rhel_aus:8.2::appstream cpe:/a:redhat:rhel_e4s:8.2::appstream cpe:/a:redhat:rhel_tus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions	Unaffected: 0:1.9.0-15.el8_2.6 < * cpe:/a:redhat:rhel_aus:8.2::appstream cpe:/a:redhat:rhel_e4s:8.2::appstream cpe:/a:redhat:rhel_tus:8.2::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:1.11.0-8.el8_4.5 < * cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service	Unaffected: 0:1.11.0-8.el8_4.5 < * cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions	Unaffected: 0:1.11.0-8.el8_4.5 < * cpe:/a:redhat:rhel_e4s:8.4::appstream cpe:/a:redhat:rhel_tus:8.4::appstream cpe:/a:redhat:rhel_aus:8.4::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	Unaffected: 0:1.12.0-6.el8_6.6 < * cpe:/a:redhat:rhel_eus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 0:1.12.0-15.el8_8.4 < * cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.13.1-3.el9_3.3 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:1.20.11-24.el9 < * cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::crb
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:22.1.9-5.el9 < * cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	Unaffected: 0:1.11.0-22.el9_0.5 < * cpe:/a:redhat:rhel_eus:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 0:1.12.0-14.el9_2.2 < * cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T08:28:21.782Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2023/12/13/1"
          },
          {
            "name": "RHSA-2023:7886",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2023:7886"
          },
          {
            "name": "RHSA-2024:0006",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0006"
          },
          {
            "name": "RHSA-2024:0009",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0009"
          },
          {
            "name": "RHSA-2024:0010",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0010"
          },
          {
            "name": "RHSA-2024:0014",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0014"
          },
          {
            "name": "RHSA-2024:0015",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0015"
          },
          {
            "name": "RHSA-2024:0016",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0016"
          },
          {
            "name": "RHSA-2024:0017",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0017"
          },
          {
            "name": "RHSA-2024:0018",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0018"
          },
          {
            "name": "RHSA-2024:0020",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:0020"
          },
          {
            "name": "RHSA-2024:2169",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2169"
          },
          {
            "name": "RHSA-2024:2170",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2170"
          },
          {
            "name": "RHSA-2024:2995",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2995"
          },
          {
            "name": "RHSA-2024:2996",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2996"
          },
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2023-6377"
          },
          {
            "name": "RHBZ#2253291",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253291"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2023/12/msg00013.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R63Z6GIWM3YUNZRCGFODUXLW3GY2HD6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PP47YXKM5ETLCYEF6473R3VFCJ6QT2S/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFHV5KCQ2SVOD4QMCPZ5HC6YL44L7YJD/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.x.org/archives/xorg-announce/2023-December/003435.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202401-30"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240125-0003/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2023/dsa-5576"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:rhel_els:6"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 6 Extended Lifecycle Support  - EXTENSION",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.1.0-25.el6_10.14",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7::server",
            "cpe:/o:redhat:enterprise_linux:7::computenode",
            "cpe:/o:redhat:enterprise_linux:7::client",
            "cpe:/o:redhat:enterprise_linux:7::workstation"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.8.0-28.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7::server",
            "cpe:/o:redhat:enterprise_linux:7::computenode",
            "cpe:/o:redhat:enterprise_linux:7::client",
            "cpe:/o:redhat:enterprise_linux:7::workstation"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.4-25.el7_9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.13.1-2.el8_9.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream",
            "cpe:/a:redhat:enterprise_linux:8::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.11-22.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:21.1.3-15.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream",
            "cpe:/a:redhat:rhel_e4s:8.2::appstream",
            "cpe:/a:redhat:rhel_tus:8.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.9.0-15.el8_2.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream",
            "cpe:/a:redhat:rhel_e4s:8.2::appstream",
            "cpe:/a:redhat:rhel_tus:8.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.9.0-15.el8_2.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_aus:8.2::appstream",
            "cpe:/a:redhat:rhel_e4s:8.2::appstream",
            "cpe:/a:redhat:rhel_tus:8.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.9.0-15.el8_2.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.11.0-8.el8_4.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.11.0-8.el8_4.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_e4s:8.4::appstream",
            "cpe:/a:redhat:rhel_tus:8.4::appstream",
            "cpe:/a:redhat:rhel_aus:8.4::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.11.0-8.el8_4.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.12.0-6.el8_6.6",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.12.0-15.el8_8.4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.13.1-3.el9_3.3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream",
            "cpe:/a:redhat:enterprise_linux:9::crb"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.20.11-24.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "xorg-x11-server-Xwayland",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:22.1.9-5.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.11.0-22.el9_0.5",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "tigervnc",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "0:1.12.0-14.el9_2.2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "xorg-x11-server",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Peter Hutterer (Red Hat)."
        }
      ],
      "datePublic": "2023-12-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-18T11:22:34.517Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2023:7886",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2023:7886"
        },
        {
          "name": "RHSA-2024:0006",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0006"
        },
        {
          "name": "RHSA-2024:0009",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0009"
        },
        {
          "name": "RHSA-2024:0010",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0010"
        },
        {
          "name": "RHSA-2024:0014",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0014"
        },
        {
          "name": "RHSA-2024:0015",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0015"
        },
        {
          "name": "RHSA-2024:0016",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0016"
        },
        {
          "name": "RHSA-2024:0017",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0017"
        },
        {
          "name": "RHSA-2024:0018",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0018"
        },
        {
          "name": "RHSA-2024:0020",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:0020"
        },
        {
          "name": "RHSA-2024:2169",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2169"
        },
        {
          "name": "RHSA-2024:2170",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2170"
        },
        {
          "name": "RHSA-2024:2995",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2995"
        },
        {
          "name": "RHSA-2024:2996",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2996"
        },
        {
          "name": "RHSA-2025:13998",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2025:13998"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2023-6377"
        },
        {
          "name": "RHBZ#2253291",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2253291"
        },
        {
          "url": "https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd"
        },
        {
          "url": "https://lists.x.org/archives/xorg-announce/2023-December/003435.html"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2023-11-30T00:00:00+00:00",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2023-12-13T00:00:00+00:00",
          "value": "Made public."
        }
      ],
      "title": "Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions",
      "workarounds": [
        {
          "lang": "en",
          "value": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
        }
      ],
      "x_redhatCweChain": "CWE-787-\u003eCWE-125: Out-of-bounds Write leads to Out-of-bounds Read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2023-6377",
    "datePublished": "2023-12-13T06:27:40.758Z",
    "dateReserved": "2023-11-29T07:38:35.722Z",
    "dateUpdated": "2025-08-18T11:22:34.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

suse-su-2023:4790-1

Vulnerability from csaf_suse

CVE-2023-6478 (GCVE-0-2023-6478)

Vulnerability from cvelistv5

CVE-2023-6377 (GCVE-0-2023-6377)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature