CVEvulnerability

CVE-2023-6816

9.8 CRITICAL Published 2024-01-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-01-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-787

Description

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

Affected configurations

• x.org x server (< 21.1.11) • x.org xwayland (< 23.2.4) • fedoraproject fedora 39 • redhat enterprise linux desktop 7.0 • redhat enterprise linux server 7.0 • redhat enterprise linux workstation 7.0 • debian debian linux 10.0

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References