CVE-2023-5367

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-5367
A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:6802 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6808 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7373 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7388 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7405 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7428 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7436 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7526 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7533 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0010 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0128 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2169
https://access.redhat.com/errata/RHSA-2024:2170
https://access.redhat.com/errata/RHSA-2024:2995
https://access.redhat.com/errata/RHSA-2024:2996
https://access.redhat.com/security/cve/CVE-2023-5367 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2243091 Issue Tracking Third Party Advisory
https://lists.x.org/archives/xorg-announce/2023-October/003430.html Patch Vendor Advisory
https://access.redhat.com/errata/RHSA-2023:6802 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6808 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7373 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7388 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7405 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7428 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7436 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7526 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7533 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0010 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0128 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2169
https://access.redhat.com/errata/RHSA-2024:2170
https://access.redhat.com/errata/RHSA-2024:2995
https://access.redhat.com/errata/RHSA-2024:2996
https://access.redhat.com/security/cve/CVE-2023-5367 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2243091 Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/
https://lists.x.org/archives/xorg-announce/2023-October/003430.html Patch Vendor Advisory
https://security.gentoo.org/glsa/202401-30
https://security.netapp.com/advisory/ntap-20231130-0004/
https://www.debian.org/security/2023/dsa-5534
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
History

21 Nov 2024, 08:41

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/ -
  • () https://security.gentoo.org/glsa/202401-30 -
  • () https://security.netapp.com/advisory/ntap-20231130-0004/ -
  • () https://www.debian.org/security/2023/dsa-5534 -
References () https://access.redhat.com/errata/RHSA-2023:6802 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:6802 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6808 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:6808 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7373 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:7373 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7388 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:7388 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7405 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:7405 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7428 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:7428 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7436 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:7436 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7526 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:7526 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7533 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2023:7533 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0010 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2024:0010 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0128 - Third Party Advisory () https://access.redhat.com/errata/RHSA-2024:0128 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:2169 - () https://access.redhat.com/errata/RHSA-2024:2169 -
References () https://access.redhat.com/errata/RHSA-2024:2170 - () https://access.redhat.com/errata/RHSA-2024:2170 -
References () https://access.redhat.com/errata/RHSA-2024:2995 - () https://access.redhat.com/errata/RHSA-2024:2995 -
References () https://access.redhat.com/errata/RHSA-2024:2996 - () https://access.redhat.com/errata/RHSA-2024:2996 -
References () https://access.redhat.com/security/cve/CVE-2023-5367 - Third Party Advisory () https://access.redhat.com/security/cve/CVE-2023-5367 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=2243091 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=2243091 - Issue Tracking, Third Party Advisory
References () https://lists.x.org/archives/xorg-announce/2023-October/003430.html - Patch, Vendor Advisory () https://lists.x.org/archives/xorg-announce/2023-October/003430.html - Patch, Vendor Advisory

16 Sep 2024, 16:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/', 'tags': ['Mailing List', 'Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://security.gentoo.org/glsa/202401-30', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://security.netapp.com/advisory/ntap-20231130-0004/', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://www.debian.org/security/2023/dsa-5534', 'tags': ['Third Party Advisory'], 'source': 'secalert@redhat.com'}

22 May 2024, 17:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:2995 -
  • () https://access.redhat.com/errata/RHSA-2024:2996 -

30 Apr 2024, 14:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:2169 -
  • () https://access.redhat.com/errata/RHSA-2024:2170 -

16 Feb 2024, 15:33

Type Values Removed Values Added
First Time Redhat enterprise Linux For Ibm Z Systems
Redhat enterprise Linux Workstation
Redhat enterprise Linux For Power Big Endian
Redhat enterprise Linux Desktop
Redhat enterprise Linux For Scientific Computing
Redhat enterprise Linux For Power Little Endian
Redhat enterprise Linux Server
References () https://access.redhat.com/errata/RHSA-2023:6802 - () https://access.redhat.com/errata/RHSA-2023:6802 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6808 - () https://access.redhat.com/errata/RHSA-2023:6808 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7373 - () https://access.redhat.com/errata/RHSA-2023:7373 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7388 - () https://access.redhat.com/errata/RHSA-2023:7388 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7405 - () https://access.redhat.com/errata/RHSA-2023:7405 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7428 - () https://access.redhat.com/errata/RHSA-2023:7428 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7436 - () https://access.redhat.com/errata/RHSA-2023:7436 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7526 - () https://access.redhat.com/errata/RHSA-2023:7526 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7533 - () https://access.redhat.com/errata/RHSA-2023:7533 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0010 - () https://access.redhat.com/errata/RHSA-2024:0010 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0128 - () https://access.redhat.com/errata/RHSA-2024:0128 - Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/ - Mailing List, Third Party Advisory
References () https://security.gentoo.org/glsa/202401-30 - () https://security.gentoo.org/glsa/202401-30 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20231130-0004/ - () https://security.netapp.com/advisory/ntap-20231130-0004/ - Third Party Advisory
CPE cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

31 Jan 2024, 13:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202401-30 -
  • () https://access.redhat.com/errata/RHSA-2024:0128 -

02 Jan 2024, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0010 -

30 Nov 2023, 22:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20231130-0004/ -

28 Nov 2023, 18:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7533 -
  • () https://access.redhat.com/errata/RHSA-2023:7526 -

21 Nov 2023, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-10-25 20:15

Updated : 2024-11-21 08:41

NVD link : CVE-2023-5367

Mitre link : CVE-2023-5367

CVE.ORG link : CVE-2023-5367

JSON object : View

Products Affected

fedoraproject

  • fedora

redhat

  • enterprise_linux_for_ibm_z_systems
  • enterprise_linux_workstation
  • enterprise_linux_for_power_big_endian
  • enterprise_linux_for_scientific_computing
  • enterprise_linux_server
  • enterprise_linux_for_power_little_endian
  • enterprise_linux
  • enterprise_linux_desktop

debian

  • debian_linux

x.org

  • xwayland
  • x_server
CWE
CWE-787

Out-of-bounds Write