A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-develUpgrade tigervnc-server-moduleUpgrade tigervnc-licenseUpgrade tigervnc-iconsUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-serverUpgrade tigervnc-server-minimalUpgrade tigervnc-selinuxUpgrade tigervncUpgrade xorg-x11-server-Xnest | Feb 1, 2024 | Jan 18, 2024 |
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | Aug 22, 2024 | Jan 18, 2024 |
| Amazon Linux Ami 2 | — | Upgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-develUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-source | Feb 21, 2024 | Jan 18, 2024 |
| Amazon_linux | — | Upgrade xorg-x11-server | Apr 29, 2024 | Jan 18, 2024 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-devel | Feb 17, 2025 | Jan 16, 2024 |
| Centos_linux | — | Upgrade tigervnc-server-appletUpgrade tigervnc-iconsUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-licenseUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XdmxUpgrade tigervnc-serverUpgrade xorg-x11-server-XephyrUpgrade tigervncUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xnest | Jan 23, 2024 | Jan 18, 2024 |
| Debian | — | Upgrade xorg-serverUpgrade xwayland | Jan 29, 2024 | Jan 18, 2024 |
| Freebsd | — | Upgrade xwaylandUpgrade xorg-serverUpgrade xephyrUpgrade xorg-vfbserverUpgrade xwayland-develUpgrade xorg-nextserver | Dec 10, 2025 | Jan 16, 2024 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | Feb 1, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 13, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | Mar 13, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade xorg-x11-server-help | May 31, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Oct 8, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade xorg-x11-server-common | Jul 24, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Apr 9, 2024 | Jan 18, 2024 |
| Oracle_linux | — | Upgrade xorg-x11-server-sourceUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-develUpgrade tigervnc-selinuxUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XdmxUpgrade tigervnc-licenseUpgrade tigervncUpgrade xorg-x11-server-XephyrUpgrade tigervnc-server-appletUpgrade tigervnc-server-moduleUpgrade tigervnc-iconsUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-minimalUpgrade tigervnc-serverUpgrade xorg-x11-server-Xwayland | Jan 23, 2024 | Jan 16, 2024 |
| Redhat_linux | — | Upgrade tigervnc-server-moduleUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xnest-debuginfoNo solution existsUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XnestUpgrade tigervncUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-develUpgrade tigervnc-serverUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-iconsUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-sourceUpgrade tigervnc-licenseUpgrade tigervnc-server-appletUpgrade tigervnc-server-minimalUpgrade tigervnc-debuginfoUpgrade tigervnc-selinuxUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-Xephyr | Jan 29, 2024 | Jan 18, 2024 |
| Rocky_linux | — | — | Aug 15, 2024 | Jan 18, 2024 |
| Suse | — | Upgrade xwaylandUpgrade xorg-x11-serverUpgrade xwayland-develUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-sdkUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-extraUpgrade xorg-x11-server-wayland | Jan 17, 2024 | Jan 17, 2024 |
| Ubuntu | — | Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xserver-xorg-coreUpgrade xwaylandUpgrade xwayland (Ubuntu Pro) | Jan 17, 2024 | Jan 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub