CVE-2023-6478

HIGH

x.org X Server < 21.1.10 and XWayland < 23.2.3 - Integer Overflow via RRChangeProviderProperty or RRChangeOutputProperty

Title source: llm

Description

A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.

References (28)

Core 28

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html

Patch

https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632

Vendor Advisory

https://lists.x.org/archives/xorg-announce/2023-December/003435.html

Third Party Advisory

https://www.debian.org/security/2023/dsa-5576

Vendor Advisory

https://security.netapp.com/advisory/ntap-20240125-0003/

Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/6R63Z6GIWM3YUNZRCGFODUXLW3GY2HD6/

Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/7PP47YXKM5ETLCYEF6473R3VFCJ6QT2S/

Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/IFHV5KCQ2SVOD4QMCPZ5HC6YL44L7YJD/

Mailing List, Third Party Advisory

https://lists.fedoraproject.org/archives/list/[email protected]/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/

Third Party Advisory

https://security.gentoo.org/glsa/202401-30

Mailing List

http://www.openwall.com/lists/oss-security/2023/12/13/1

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2023:7886

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:0006

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:0009

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:0010

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:0014

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:0015

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:0016

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:0017

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:0018

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:0020

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:2169

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:2170

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:2995

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2024:2996

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2025:12751

Vendor Advisory vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2023-6478

Issue Tracking issue-tracking x_refsource_redhat

https://bugzilla.redhat.com/show_bug.cgi?id=2253298

Scores

CVSS v3 7.6

EPSS 0.0111

EPSS Percentile 78.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Details

CWE

CWE-190

Status published

Products (7)

debian/debian_linux 10.0

debian/debian_linux 11.0

debian/debian_linux 12.0

redhat/enterprise_linux_eus 9.2

tigervnc/tigervnc

x.org/x_server < 21.1.10

x.org/xwayland < 23.2.3

Published Dec 13, 2023

Tracked Since Feb 18, 2026