CVE-2023-6816

CRITICAL

X.Org Server < 21.1.11 and XWayland < 23.2.4 - Out-of-bounds Write via Button Mapping

Title source: llm
STIX 2.1

Description

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

References (24)

Core 24
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0320
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0557
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0558
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0597
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0607
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0614
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0617
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0621
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0626
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:0629
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:2169
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:2170
Vendor Advisory vendor-advisory x_refsource_redhat
RHSA-2024:2995
https://access.redhat.com/errata/RHSA-2024:2995
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2024:2996
Vendor Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2025:12751
Third Party Advisory vdb-entry x_refsource_redhat
https://access.redhat.com/security/cve/CVE-2023-6816
Issue Tracking issue-tracking x_refsource_redhat
https://bugzilla.redhat.com/show_bug.cgi?id=2257691

Scores

CVSS v3 9.8
EPSS 0.0301
EPSS Percentile 86.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-787
Status published
Products (27)
debian/debian_linux 10.0
fedoraproject/fedora 39
Red Hat/Red Hat Enterprise Linux 6
Red Hat/Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION 0:1.1.0-25.el6_10.13
Red Hat/Red Hat Enterprise Linux 7 0:1.20.4-27.el7_9
Red Hat/Red Hat Enterprise Linux 7 0:1.8.0-31.el7_9
Red Hat/Red Hat Enterprise Linux 8 0:1.13.1-2.el8_9.7
Red Hat/Red Hat Enterprise Linux 8 0:1.20.11-22.el8
Red Hat/Red Hat Enterprise Linux 8 0:21.1.3-15.el8
Red Hat/Red Hat Enterprise Linux 8.2 Advanced Update Support 0:1.9.0-15.el8_2.9
... and 17 more
Published Jan 18, 2024
Tracked Since Feb 18, 2026