CVE-2023-5367

High

Description

A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.

SeverityHigh

CVSS7.8

Exploit probability—

Product

X.org X Server

PublishedOct 25, 2023

First seenOct 25, 2023

Weakness typeCWE-787Out-of-bounds write

How to fix

Update

x.org x_server21.1.9 or later
x.org xwayland23.2.2 or later

Patches

lists.x.org/archives/xorg-announce/2023-October/003430.html

Vendor advisories

Affected products

Product	Affected versions	Fixed in
x.org x_server	v < 21.1.9	21.1.9
x.org xwayland	v < 23.2.2	23.2.2
redhat enterprise_linux	7.0, 8.0, 9.0	—
redhat enterprise_linux_desktop	7.0	—
redhat enterprise_linux_for_ibm_z_systems	7.0_s390x	—
redhat enterprise_linux_for_power_big_endian	7.0_ppc64	—
redhat enterprise_linux_for_power_little_endian	7.0_ppc64le	—
redhat enterprise_linux_for_scientific_computing	7.0	—
redhat enterprise_linux_server	7.0	—
redhat enterprise_linux_workstation	7.0	—
fedoraproject fedora	37, 38, 39	—
debian debian_linux	11.0, 12.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.