CVE-2023-6377

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-6377
A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:7886 Vendor Advisory
https://access.redhat.com/errata/RHSA-2024:0006
https://access.redhat.com/errata/RHSA-2024:0009
https://access.redhat.com/errata/RHSA-2024:0010
https://access.redhat.com/errata/RHSA-2024:0014
https://access.redhat.com/errata/RHSA-2024:0015
https://access.redhat.com/errata/RHSA-2024:0016
https://access.redhat.com/errata/RHSA-2024:0017
https://access.redhat.com/errata/RHSA-2024:0018
https://access.redhat.com/errata/RHSA-2024:0020
https://access.redhat.com/errata/RHSA-2024:2169
https://access.redhat.com/errata/RHSA-2024:2170
https://access.redhat.com/errata/RHSA-2024:2995
https://access.redhat.com/errata/RHSA-2024:2996
https://access.redhat.com/security/cve/CVE-2023-6377 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2253291 Issue Tracking
https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd Patch
https://lists.x.org/archives/xorg-announce/2023-December/003435.html Mailing List
Configurations

Configuration 1 (hide)

cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:a:tigervnc:tigervnc:-:*:*:*:*:*:*:*
OR cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
History

16 Sep 2024, 16:15

Type Values Removed Values Added
References
  • {'url': 'http://www.openwall.com/lists/oss-security/2023/12/13/1', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.debian.org/debian-lts-announce/2023/12/msg00013.html', 'tags': ['Mailing List'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R63Z6GIWM3YUNZRCGFODUXLW3GY2HD6/', 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PP47YXKM5ETLCYEF6473R3VFCJ6QT2S/', 'tags': ['Vendor Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFHV5KCQ2SVOD4QMCPZ5HC6YL44L7YJD/', 'source': 'secalert@redhat.com'}
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/', 'tags': ['Vendor Advisory'], 'source': 'secalert@redhat.com'}
  • {'url': 'https://security.gentoo.org/glsa/202401-30', 'source': 'secalert@redhat.com'}
  • {'url': 'https://security.netapp.com/advisory/ntap-20240125-0003/', 'source': 'secalert@redhat.com'}
  • {'url': 'https://www.debian.org/security/2023/dsa-5576', 'tags': ['Vendor Advisory'], 'source': 'secalert@redhat.com'}

22 May 2024, 17:16

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:2995 -
  • () https://access.redhat.com/errata/RHSA-2024:2996 -

30 Apr 2024, 14:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:2169 -
  • () https://access.redhat.com/errata/RHSA-2024:2170 -

31 Jan 2024, 13:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202401-30 -

25 Jan 2024, 14:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFHV5KCQ2SVOD4QMCPZ5HC6YL44L7YJD/ -
  • () https://security.netapp.com/advisory/ntap-20240125-0003/ -

02 Jan 2024, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0016 -
  • () https://access.redhat.com/errata/RHSA-2024:0017 -
  • () https://access.redhat.com/errata/RHSA-2024:0020 -
  • () https://access.redhat.com/errata/RHSA-2024:0015 -
  • () https://access.redhat.com/errata/RHSA-2024:0014 -
  • () https://access.redhat.com/errata/RHSA-2024:0006 -
  • () https://access.redhat.com/errata/RHSA-2024:0018 -
  • () https://access.redhat.com/errata/RHSA-2024:0010 -
  • () https://access.redhat.com/errata/RHSA-2024:0009 -

25 Dec 2023, 04:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R63Z6GIWM3YUNZRCGFODUXLW3GY2HD6/ -

21 Dec 2023, 17:18

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PP47YXKM5ETLCYEF6473R3VFCJ6QT2S/ - Vendor Advisory
  • () https://access.redhat.com/errata/RHSA-2023:7886 - Vendor Advisory
References () https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd - () https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd - Patch
References () https://bugzilla.redhat.com/show_bug.cgi?id=2253291 - () https://bugzilla.redhat.com/show_bug.cgi?id=2253291 - Issue Tracking
References () https://lists.x.org/archives/xorg-announce/2023-December/003435.html - () https://lists.x.org/archives/xorg-announce/2023-December/003435.html - Mailing List
References () https://lists.debian.org/debian-lts-announce/2023/12/msg00013.html - () https://lists.debian.org/debian-lts-announce/2023/12/msg00013.html - Mailing List
References () https://www.debian.org/security/2023/dsa-5576 - () https://www.debian.org/security/2023/dsa-5576 - Vendor Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/ - Vendor Advisory
References () https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html - () https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html - Mailing List
References () https://access.redhat.com/security/cve/CVE-2023-6377 - () https://access.redhat.com/security/cve/CVE-2023-6377 - Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2023/12/13/1 - () http://www.openwall.com/lists/oss-security/2023/12/13/1 - Mailing List
CPE cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:a:tigervnc:tigervnc:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
CWE CWE-125

17 Dec 2023, 20:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2023/12/msg00013.html -

15 Dec 2023, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/ -

13 Dec 2023, 15:15

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2023/12/13/1 -

13 Dec 2023, 13:35

Type Values Removed Values Added
References
  • () https://www.debian.org/security/2023/dsa-5576 -

13 Dec 2023, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-13 07:15

Updated : 2024-09-16 16:15

NVD link : CVE-2023-6377

Mitre link : CVE-2023-6377

CVE.ORG link : CVE-2023-6377

JSON object : View

Products Affected

debian

  • debian_linux

x.org

  • x_server
  • xwayland

tigervnc

  • tigervnc

redhat

  • enterprise_linux
  • enterprise_linux_eus
CWE
CWE-125

Out-of-bounds Read