CVE-2023-6478

HIGH

xorg-server - Info Disclosure

Title source: llm

Description

A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.

References (28)

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2023:7886

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:0006

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:0009

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:0010

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:0014

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:0015

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:0016

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2024:0017

[Vendor Advisory] https://access.redhat.com/security/cve/CVE-2023-6478

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=2253298

[Patch] https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632

[Vendor Advisory] https://lists.x.org/archives/xorg-announce/2023-December/003435.html

[Mailing List] https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html

[Third Party Advisory] https://www.debian.org/security/2023/dsa-5576

[Vendor Advisory] https://security.netapp.com/advisory/ntap-20240125-0003/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/[email protected]/message/6R63Z6GIWM3YUNZRCGFODUXLW3GY2HD6/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/[email protected]/message/7PP47YXKM5ETLCYEF6473R3VFCJ6QT2S/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/[email protected]/message/IFHV5KCQ2SVOD4QMCPZ5HC6YL44L7YJD/

[Mailing List, Third Party Advisory] https://lists.fedoraproject.org/archives/list/[email protected]/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/

[Third Party Advisory] https://security.gentoo.org/glsa/202401-30

... and 8 more

Scores

CVSS v3 7.6

EPSS 0.0121

EPSS Percentile 78.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Classification

CWE

CWE-190

Status published

Affected Products (7)

x.org/x_server < 21.1.10

x.org/xwayland < 23.2.3

redhat/enterprise_linux_eus

debian/debian_linux

tigervnc/tigervnc

Timeline

Published Dec 13, 2023

Tracked Since Feb 18, 2026