This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2023-6816 →
Unrated
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can...
ALPINE-CVE-2023-6816
First seen on SecPulse
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| Alpine:v3.19xorg-server |
< 21.1.11-r0→ 21.1.11-r0 |
21.1.11-r0 |
| Alpine:v3.20xorg-server |
< 21.1.11-r0→ 21.1.11-r0 |
21.1.11-r0 |
| Alpine:v3.21xorg-server |
< 21.1.11-r0→ 21.1.11-r0 |
21.1.11-r0 |
| Alpine:v3.22xorg-server |
< 21.1.11-r0→ 21.1.11-r0 |
21.1.11-r0 |
| Alpine:v3.23xorg-server |
< 21.1.11-r0→ 21.1.11-r0 |
21.1.11-r0 |
| Alpine:v3.24xorg-server |
< 21.1.11-r0→ 21.1.11-r0 |
21.1.11-r0 |
| Alpine:v3.19xwayland |
< 23.2.4-r0→ 23.2.4-r0 |
23.2.4-r0 |
| Alpine:v3.20xwayland |
< 23.2.4-r0→ 23.2.4-r0 |
23.2.4-r0 |
| Alpine:v3.21xwayland |
< 23.2.4-r0→ 23.2.4-r0 |
23.2.4-r0 |
| Alpine:v3.22xwayland |
< 23.2.4-r0→ 23.2.4-r0 |
23.2.4-r0 |
| Alpine:v3.23xwayland |
< 23.2.4-r0→ 23.2.4-r0 |
23.2.4-r0 |
| Alpine:v3.24xwayland |
< 23.2.4-r0→ 23.2.4-r0 |
23.2.4-r0 |
Original description The description as published by the source.
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.
Source: OSV.dev (Open Source Vulnerabilities) OSV
References
- advisory security.alpinelinux.org