A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xorg-x11-server-XnestUpgrade tigervnc-selinuxUpgrade tigervnc-server-minimalUpgrade tigervncUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-serverUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XvfbUpgrade tigervnc-licenseUpgrade xorg-x11-server-commonUpgrade tigervnc-iconsUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-develUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-Xdmx | Feb 1, 2024 | Jan 18, 2024 |
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | Aug 22, 2024 | Jan 18, 2024 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-debuginfo | Feb 21, 2024 | Jan 18, 2024 |
| Amazon_linux | — | Upgrade xorg-x11-server | Apr 29, 2024 | Jan 18, 2024 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-develUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xorg | Feb 17, 2025 | Jan 16, 2024 |
| Centos_linux | — | Upgrade xorg-x11-server-XephyrUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-XdmxUpgrade tigervnc-serverUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XvfbUpgrade tigervncUpgrade tigervnc-licenseUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XnestUpgrade tigervnc-server-appletUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-iconsUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-common | Jan 23, 2024 | Jan 18, 2024 |
| Debian | — | Upgrade xorg-serverUpgrade xwayland | Jan 29, 2024 | Jan 18, 2024 |
| Freebsd | — | Upgrade xorg-serverUpgrade xephyrUpgrade xorg-vfbserverUpgrade xwayland-develUpgrade xorg-nextserverUpgrade xwayland | Dec 10, 2025 | Jan 16, 2024 |
| Gentoo Linux | — | Upgrade x11-base/xwayland.Upgrade x11-base/xorg-server. | Feb 1, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 13, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | Mar 13, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade xorg-x11-server-help | May 31, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Oct 8, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Jul 24, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Apr 9, 2024 | Jan 18, 2024 |
| Oracle_linux | — | Upgrade tigervnc-server-minimalUpgrade xorg-x11-server-XorgUpgrade tigervnc-iconsUpgrade tigervnc-server-appletUpgrade tigervnc-serverUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-server-moduleUpgrade tigervnc-licenseUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-develUpgrade tigervncUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-sourceUpgrade tigervnc-selinux | Jan 23, 2024 | Jan 16, 2024 |
| Redhat_linux | — | Upgrade xorg-x11-server-Xdmx-debuginfoUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-iconsUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XvfbUpgrade tigervnc-licenseUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-appletUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-selinuxUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-debugsourceUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-commonUpgrade tigervncNo solution existsUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-serverUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XdmxUpgrade tigervnc-server-debuginfo | Jan 29, 2024 | Jan 18, 2024 |
| Rocky_linux | — | — | Aug 15, 2024 | Jan 18, 2024 |
| Suse | — | Upgrade xorg-x11-server-extraUpgrade xorg-x11-server-waylandUpgrade xwaylandUpgrade xorg-x11-serverUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-sdkUpgrade xorg-x11-server-XvfbUpgrade xwayland-devel | Jan 17, 2024 | Jan 17, 2024 |
| Ubuntu | — | Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xserver-xorg-coreUpgrade xwaylandUpgrade xwayland (Ubuntu Pro) | Jan 17, 2024 | Jan 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub