Out-of-bounds Write Affecting xorg-server package, versions <2:1.20.4-1+deb10u13
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN10-XORGSERVER-6159333
- published 16 Jan 2024
- disclosed 18 Jan 2024
Introduced: 16 Jan 2024
CVE-2023-6816 Open this link in a new tabHow to fix?
Upgrade Debian:10
xorg-server
to version 2:1.20.4-1+deb10u13 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream xorg-server
package and not the xorg-server
package as distributed by Debian
.
See How to fix?
for Debian:10
relevant fixed versions and status.
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.
References
- https://security-tracker.debian.org/tracker/CVE-2023-6816
- https://access.redhat.com/security/cve/CVE-2023-6816
- https://bugzilla.redhat.com/show_bug.cgi?id=2257691
- http://www.openwall.com/lists/oss-security/2024/01/18/1
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5J4H7CH565ALSZZYKOJFYDA5KFLG6NUK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EJBMCWQ54R6ZL3MYU2D2JBW6JMZL7BQW/
- https://access.redhat.com/errata/RHSA-2024:0320
- https://lists.debian.org/debian-lts-announce/2024/01/msg00016.html
- https://access.redhat.com/errata/RHSA-2024:0557
- https://access.redhat.com/errata/RHSA-2024:0558
- https://access.redhat.com/errata/RHSA-2024:0597
- https://access.redhat.com/errata/RHSA-2024:0607
- https://access.redhat.com/errata/RHSA-2024:0614
- https://access.redhat.com/errata/RHSA-2024:0621
- https://security.gentoo.org/glsa/202401-30
- https://access.redhat.com/errata/RHSA-2024:0617
- https://access.redhat.com/errata/RHSA-2024:0626
- https://access.redhat.com/errata/RHSA-2024:0629
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZ75X54CN4IFYMIV7OK3JVZ57FHQIGIC/
- https://security.netapp.com/advisory/ntap-20240307-0006/