CVE-2024-0409
High
Description
A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
SeverityHigh
CVSS7.8
Exploit probability—
Product
X.org Xwayland
PublishedJan 18, 2024
First seenJan 18, 2024
Weakness typeCWE-787Out-of-bounds write
How to fix
Update
- x.org xwayland23.2.4 or later
- tigervnc tigervnc1.13.1 or later
- x.org x_server21.1.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| x.org xwayland | v < 23.2.4 | 23.2.4 |
| tigervnc tigervnc | v < 1.13.1 | 1.13.1 |
| x.org x_server | v < 21.1.11 | 21.1.11 |
| fedoraproject fedora | 39 | — |
| redhat enterprise_linux | 6.0, 7.0, 8.0, 9.0 | — |
| redhat enterprise_linux_desktop | 7.0 | — |
| redhat enterprise_linux_for_ibm_z_systems | 7.0 | — |
| redhat enterprise_linux_for_power_big_endian | 7.0 | — |
| redhat enterprise_linux_for_power_little_endian | 7.0 | — |
| redhat enterprise_linux_for_scientific_computing | 7.0 | — |
| redhat enterprise_linux_server | 7.0 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.