CVEvulnerability

CVE-2024-0409

7.8 HIGH Published 2024-01-18 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2024-01-18
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-787

Description

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.

Affected configurations

• tigervnc tigervnc (< 1.13.1) • x.org x server (< 21.1.11) • x.org xwayland (< 23.2.4) • fedoraproject fedora 39 • redhat enterprise linux 6.0 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • redhat enterprise linux desktop 7.0 • redhat enterprise linux for ibm z systems 7.0 • redhat enterprise linux for power big endian 7.0 • redhat enterprise linux for power little endian 7.0 • redhat enterprise linux for scientific computing 7.0 • redhat enterprise linux server 7.0 • redhat enterprise linux workstation 7.0

Related

Weakness · CWE (1)

  • CWE-787 Out-of-bounds Write weakness

References