Critical 9.8

Xorg-x11-serverにヒープバッファオーバーフローの脆弱性、特権昇格や任意コード実行のおそれ

CVE-2023-6816 First seen on SecPulse Jan 18, 2024

Summary

2024年1月に公表された古いCVEです。X.Org Serverでは、DeviceFocusEventとXIQueryPointerの応答でボタン状態を確認する際に、割り当て領域を超えて書き込まれるヒープバッファオーバーフローが起きます。CVSSは9.8で、深刻度は緊急です。修正版の情報は本記事の事実に含まれていないため、最新の情報を確認してください。

AI summary

Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.

Fix status by distribution

Records published by each distribution for this CVE. Fixed versions differ by release; check each link.

Alpine Linux ALPINE-CVE-2023-6816 xwayland, xorg-server Fix available
Debian DEBIAN-CVE-2023-6816 xwayland, xorg-server Fix available

Original description The description as published by the source.

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

Source: CVE.org (CVE Program・cvelistV5) NVD

Summary

AI summary

Fix status by distribution

References