A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XorgUpgrade tigervnc-licenseUpgrade tigervnc-iconsUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XdmxUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XnestUpgrade tigervnc-server-minimalUpgrade tigervnc-serverUpgrade tigervncUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-selinux | Feb 1, 2024 | Jan 18, 2024 |
| Alpine Linux | alpine-linux-upgrade-xorg-serveralpine-linux-upgrade-xwayland | Aug 22, 2024 | Jan 18, 2024 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-xorg-x11-server-commonamazon-linux-ami-2-upgrade-xorg-x11-server-debuginfoamazon-linux-ami-2-upgrade-xorg-x11-server-develamazon-linux-ami-2-upgrade-xorg-x11-server-sourceamazon-linux-ami-2-upgrade-xorg-x11-server-xdmxamazon-linux-ami-2-upgrade-xorg-x11-server-xephyramazon-linux-ami-2-upgrade-xorg-x11-server-xnestamazon-linux-ami-2-upgrade-xorg-x11-server-xorgamazon-linux-ami-2-upgrade-xorg-x11-server-xvfbamazon-linux-ami-2-upgrade-xorg-x11-server-xwayland | Feb 21, 2024 | Jan 18, 2024 | |
| Amazon_linux | — | amazon-linux-upgrade-xorg-x11-server | Apr 29, 2024 | Jan 18, 2024 |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-xorg-x11-server-commonamazon-linux-2023-upgrade-xorg-x11-server-debuginfoamazon-linux-2023-upgrade-xorg-x11-server-debugsourceamazon-linux-2023-upgrade-xorg-x11-server-develamazon-linux-2023-upgrade-xorg-x11-server-sourceamazon-linux-2023-upgrade-xorg-x11-server-xdmxamazon-linux-2023-upgrade-xorg-x11-server-xdmx-debuginfoamazon-linux-2023-upgrade-xorg-x11-server-xephyramazon-linux-2023-upgrade-xorg-x11-server-xephyr-debuginfoamazon-linux-2023-upgrade-xorg-x11-server-xnestamazon-linux-2023-upgrade-xorg-x11-server-xnest-debuginfoamazon-linux-2023-upgrade-xorg-x11-server-xorgamazon-linux-2023-upgrade-xorg-x11-server-xorg-debuginfoamazon-linux-2023-upgrade-xorg-x11-server-xvfbamazon-linux-2023-upgrade-xorg-x11-server-xvfb-debuginfo | Feb 17, 2025 | Jan 16, 2024 | |
| Centos_linux | — | Upgrade tigervnc-server-moduleUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-sourceUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-server-appletUpgrade tigervnc-iconsUpgrade tigervncUpgrade tigervnc-serverUpgrade tigervnc-licenseUpgrade xorg-x11-server-develUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xephyr | Jan 23, 2024 | Jan 18, 2024 |
| Debian | debian-upgrade-xorg-server | Jan 29, 2024 | Jan 18, 2024 | |
| Freebsd | — | Upgrade xwaylandUpgrade xwayland-develUpgrade xephyrUpgrade xorg-serverUpgrade xorg-nextserverUpgrade xorg-vfbserver | Dec 10, 2025 | Jan 16, 2024 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | Feb 1, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Mar 13, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | Mar 13, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade xorg-x11-server-help | May 31, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp5 | — | Upgrade xorg-x11-server-common | Oct 8, 2024 | Jan 18, 2024 |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-xorg-x11-server-commonhuawei-euleros-2_0_sp8-upgrade-xorg-x11-server-xephyrhuawei-euleros-2_0_sp8-upgrade-xorg-x11-server-xorghuawei-euleros-2_0_sp8-upgrade-xorg-x11-server-xvfbhuawei-euleros-2_0_sp8-upgrade-xorg-x11-server-xwayland | Jul 24, 2024 | Jan 18, 2024 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-xorg-x11-server-help | Apr 9, 2024 | Jan 18, 2024 | |
| Oracle_linux | — | oracle-linux-upgrade-tigervncoracle-linux-upgrade-tigervnc-iconsoracle-linux-upgrade-tigervnc-licenseoracle-linux-upgrade-tigervnc-selinuxoracle-linux-upgrade-tigervnc-serveroracle-linux-upgrade-tigervnc-server-appletoracle-linux-upgrade-tigervnc-server-minimaloracle-linux-upgrade-tigervnc-server-moduleoracle-linux-upgrade-xorg-x11-server-commonoracle-linux-upgrade-xorg-x11-server-develoracle-linux-upgrade-xorg-x11-server-sourceoracle-linux-upgrade-xorg-x11-server-xdmxoracle-linux-upgrade-xorg-x11-server-xephyroracle-linux-upgrade-xorg-x11-server-xnestoracle-linux-upgrade-xorg-x11-server-xorgoracle-linux-upgrade-xorg-x11-server-xvfboracle-linux-upgrade-xorg-x11-server-xwayland | Jan 23, 2024 | Jan 16, 2024 |
| Redhat_linux | redhat-upgrade-tigervncredhat-upgrade-tigervnc-debuginforedhat-upgrade-tigervnc-debugsourceredhat-upgrade-tigervnc-iconsredhat-upgrade-tigervnc-licenseredhat-upgrade-tigervnc-selinuxredhat-upgrade-tigervnc-serverredhat-upgrade-tigervnc-server-appletredhat-upgrade-tigervnc-server-debuginforedhat-upgrade-tigervnc-server-minimalredhat-upgrade-tigervnc-server-minimal-debuginforedhat-upgrade-tigervnc-server-moduleredhat-upgrade-tigervnc-server-module-debuginforedhat-upgrade-xorg-x11-server-commonredhat-upgrade-xorg-x11-server-debuginforedhat-upgrade-xorg-x11-server-debugsourceredhat-upgrade-xorg-x11-server-develredhat-upgrade-xorg-x11-server-sourceredhat-upgrade-xorg-x11-server-xdmxredhat-upgrade-xorg-x11-server-xdmx-debuginforedhat-upgrade-xorg-x11-server-xephyrredhat-upgrade-xorg-x11-server-xephyr-debuginforedhat-upgrade-xorg-x11-server-xnestredhat-upgrade-xorg-x11-server-xnest-debuginforedhat-upgrade-xorg-x11-server-xorgredhat-upgrade-xorg-x11-server-xorg-debuginforedhat-upgrade-xorg-x11-server-xvfbredhat-upgrade-xorg-x11-server-xvfb-debuginforedhat-upgrade-xorg-x11-server-xwaylandredhat-upgrade-xorg-x11-server-xwayland-debuginforedhat-upgrade-xorg-x11-server-xwayland-debugsource | Jan 29, 2024 | Jan 18, 2024 | |
| Suse | — | suse-upgrade-xorg-x11-serversuse-upgrade-xorg-x11-server-extrasuse-upgrade-xorg-x11-server-sdksuse-upgrade-xorg-x11-server-sourcesuse-upgrade-xorg-x11-server-waylandsuse-upgrade-xorg-x11-server-xvfbsuse-upgrade-xwaylandsuse-upgrade-xwayland-devel | Jan 17, 2024 | Jan 17, 2024 |
| Ubuntu | ubuntu-pro-upgrade-xserver-xorg-coreubuntu-pro-upgrade-xwaylandubuntu-upgrade-xserver-xorg-coreubuntu-upgrade-xwayland | Jan 17, 2024 | Jan 16, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub