CVE-2023-6816

CRITICAL

X.org X Server < 21.1.11 - Out-of-Bounds Write

Title source: rule

Description

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

References (23)

... and 3 more

Scores

CVSS v3 9.8
EPSS 0.0326
EPSS Percentile 86.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-787
Status published

Affected Products (7)

x.org/x_server < 21.1.11
x.org/xwayland < 23.2.4
fedoraproject/fedora
redhat/enterprise_linux_desktop
redhat/enterprise_linux_server
redhat/enterprise_linux_workstation
debian/debian_linux

Timeline

Published Jan 18, 2024
Tracked Since Feb 18, 2026