Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty
Summary
| CVE | CVE-2023-6478 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2023-12-13 07:15:31 UTC |
| Updated | 2026-06-23 18:17:38 UTC |
| Description | A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information. |
Risk And Classification
Primary CVSS: v3.1 7.5 HIGH from [email protected]
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-190 | CWE-190 Integer Overflow or Wraparound
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | [email protected] | Secondary | 7.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
| 3.1 | CNA | CVSS | 7.6 | HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Redhat | Enterprise Linux | 6.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 9.0 | All | All | All |
| Application | X.org | Xwayland | All | All | All | All |
| Application | X.org | X Server | All | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | unaffected 0:1.1.0-25.el6_10.13 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | unaffected 0:1.8.0-28.el7_9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | unaffected 0:1.20.4-25.el7_9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:1.13.1-2.el8_9.4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:1.20.11-22.el8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:21.1.3-15.el8 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | unaffected 0:1.9.0-15.el8_2.6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.2 Telecommunications Update Service | unaffected 0:1.9.0-15.el8_2.6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.2 Update Services For SAP Solutions | unaffected 0:1.9.0-15.el8_2.6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 0:1.11.0-8.el8_4.5 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | unaffected 0:1.11.0-8.el8_4.5 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Update Services For SAP Solutions | unaffected 0:1.11.0-8.el8_4.5 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | unaffected 0:1.12.0-6.el8_6.6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | unaffected 0:1.12.0-15.el8_8.4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:1.13.1-3.el9_3.3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:1.20.11-24.el9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:22.1.9-5.el9 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | unaffected 0:1.11.0-22.el9_0.5 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | unaffected 0:1.12.0-14.el9_2.2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| X.Org X Server, XWayland: Multiple Vulnerabilities (GLSA 202401-30) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| oss-security - FW: X.Org Security Advisory: Issues in X.Org X server prior to 21.1.10 and Xwayland prior to 23.2.3 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| December 2023 X.Org X Server Vulnerabilities in NetApp Products | NetApp Product Security | af854a3a-2127-422b-91ae-364da2661108 | security.netapp.com | |
| access.redhat.com/errata/RHSA-2024:0015 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0017 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| lists.x.org/archives/xorg-announce/2023-December/003435.html | af854a3a-2127-422b-91ae-364da2661108 | lists.x.org | Vendor Advisory |
| access.redhat.com/security/cve/CVE-2023-6478 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| lists.fedoraproject.org/archives/list/[email protected]/messag... | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| access.redhat.com/errata/RHSA-2024:0006 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| lists.fedoraproject.org/archives/list/[email protected]/messag... | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| bugzilla.redhat.com/show_bug.cgi | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | Issue Tracking |
| [SECURITY] Fedora 38 Update: tigervnc-1.13.1-9.fc38 - package-announce - Fedora Mailing-Lists | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| access.redhat.com/errata/RHSA-2024:2995 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2023:7886 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | Vendor Advisory |
| access.redhat.com/errata/RHSA-2024:2169 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0009 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| lists.fedoraproject.org/archives/list/[email protected]/messag... | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| access.redhat.com/errata/RHSA-2025:12751 | [email protected] | access.redhat.com | |
| lists.debian.org/debian-lts-announce/2023/12/msg00008.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| access.redhat.com/errata/RHSA-2024:2996 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:2170 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| www.debian.org/security/2023/dsa-5576 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632 | af854a3a-2127-422b-91ae-364da2661108 | gitlab.freedesktop.org | Patch |
| access.redhat.com/errata/RHSA-2024:0018 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0010 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0016 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0014 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| access.redhat.com/errata/RHSA-2024:0020 | af854a3a-2127-422b-91ae-364da2661108 | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: This issue was discovered by Peter Hutterer (Red Hat). (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2023-11-30T00:00:00.000Z | Reported to Red Hat. |
| CNA | 2023-12-13T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Legacy QID Mappings
- 161260 Oracle Enterprise Linux Security Update for xorg-x11-server (ELSA-2024-0009)
- 161261 Oracle Enterprise Linux Security Update for tigervnc (ELSA-2024-0006)
- 161265 Oracle Enterprise Linux Security Update for tigervnc (ELSA-2024-0010)
- 161267 Oracle Enterprise Linux Security Update for tigervnc (ELSA-2024-0018)
- 200008 Ubuntu Security Notification for X.Org X Server Vulnerabilities (USN-6555-2)
- 200009 Ubuntu Security Notification for X.Org X Server Vulnerabilities (USN-6555-1)
- 200193 Ubuntu Security Notification for X.Org X Server Vulnerabilities (USN-6587-5)
- 242635 Red Hat Update for tigervnc (RHSA-2023:7886)
- 242638 Red Hat Update for tigervnc (RHSA-2024:0017)
- 242648 Red Hat Update for tigervnc (RHSA-2024:0006)
- 242649 Red Hat Update for tigervnc (RHSA-2024:0020)
- 242650 Red Hat Update for tigervnc (RHSA-2024:0015)
- 242652 Red Hat Update for tigervnc (RHSA-2024:0014)
- 242654 Red Hat Update for tigervnc (RHSA-2024:0018)
- 242660 Red Hat Update for tigervnc (RHSA-2024:0010)
- 242662 Red Hat Update for tigervnc (RHSA-2024:0016)
- 242665 Red Hat Update for xorg-x11-server (RHSA-2024:0009)
- 257273 Centos Security Update for tigervnc
- 257274 Centos Security Update for xorg-x11-server
- 257276 CentOS Security Update for tigervnc (CESA-2024:0006)
- 257278 CentOS Security Update for xorg-x11-server (CESA-2024:0009)
- 284828 Fedora Security Update for xorg (FEDORA-2023-77c8903bcb)
- 284852 Fedora Security Update for tigervnc (FEDORA-2023-ec02e360af)
- 285097 Fedora Security Update for xorg (FEDORA-2023-93940b58fd)
- 285098 Fedora Security Update for tigervnc (FEDORA-2023-52460bedda)
- 296108 Oracle Solaris 11.4 Support Repository Update (SRU) 66.164.1 Missing (CPUJAN2024)
- 357185 Amazon Linux Security Advisory for xorg-x11-server : AL2012-2024-484
- 357249 Amazon Linux Security Advisory for xorg-x11-server : ALAS2023-2024-522
- 379273 Alibaba Cloud Linux Security Update for xorg-x11-server (ALINUX2-SA-2024:0002)
- 379625 Alibaba Cloud Linux Security Update for tigervnc (ALINUX3-SA-2024:0028)
- 505836 Alpine Linux Security Update for xorg-server
- 6000380 Debian Security Update for xorg-server (DLA 3686-1)
- 6000381 Debian Security Update for xorg-server (DSA 5576-1)
- 673396 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1210)
- 673399 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1352)
- 673442 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1307)
- 673626 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1232)
- 673924 EulerOS Security Update for tigervnc (EulerOS-SA-2024-1304)
- 673929 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1254)
- 673935 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1330)
- 674012 EulerOS Security Update for xorg-x11-server (EulerOS-SA-2024-1190)
- 691374 Free Berkeley Software Distribution (FreeBSD) Security Update for xorg (972568d6-3485-40ab-80ff-994a8aaf9683)
- 710847 Gentoo Linux X.Org X Server, XWayland Multiple Vulnerabilities (GLSA 202401-30)
- 755403 SUSE Enterprise Linux Security Update for xwayland (SUSE-SU-2023:4792-1)
- 755404 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2023:4791-1)
- 755405 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2023:4790-1)
- 755406 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2023:4789-1)
- 755407 SUSE Enterprise Linux Security Update for xwayland (SUSE-SU-2023:4788-1)
- 755408 SUSE Enterprise Linux Security Update for xorg-x11-server (SUSE-SU-2023:4787-1)
- 941513 AlmaLinux Security Update for tigervnc (ALSA-2024:0010)
- 941516 AlmaLinux Security Update for tigervnc (ALSA-2024:0018)