CVE-2023-5367

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-5367
A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://access.redhat.com/errata/RHSA-2023:6802 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:6808 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7373 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7388 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7405 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7428 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7436 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7526 Third Party Advisory
https://access.redhat.com/errata/RHSA-2023:7533 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0010 Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:0128 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2023-5367 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2243091 Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/ Mailing List
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/ Mailing List Third Party Advisory
https://lists.x.org/archives/xorg-announce/2023-October/003430.html Patch Vendor Advisory
https://security.gentoo.org/glsa/202401-30 Third Party Advisory
https://security.netapp.com/advisory/ntap-20231130-0004/ Third Party Advisory
https://www.debian.org/security/2023/dsa-5534 Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
History

16 Feb 2024, 15:33

Type Values Removed Values Added
References () https://access.redhat.com/errata/RHSA-2023:6802 - () https://access.redhat.com/errata/RHSA-2023:6802 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:6808 - () https://access.redhat.com/errata/RHSA-2023:6808 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7373 - () https://access.redhat.com/errata/RHSA-2023:7373 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7388 - () https://access.redhat.com/errata/RHSA-2023:7388 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7405 - () https://access.redhat.com/errata/RHSA-2023:7405 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7428 - () https://access.redhat.com/errata/RHSA-2023:7428 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7436 - () https://access.redhat.com/errata/RHSA-2023:7436 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7526 - () https://access.redhat.com/errata/RHSA-2023:7526 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2023:7533 - () https://access.redhat.com/errata/RHSA-2023:7533 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0010 - () https://access.redhat.com/errata/RHSA-2024:0010 - Third Party Advisory
References () https://access.redhat.com/errata/RHSA-2024:0128 - () https://access.redhat.com/errata/RHSA-2024:0128 - Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/ - Mailing List, Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/ - Mailing List, Third Party Advisory
References () https://security.gentoo.org/glsa/202401-30 - () https://security.gentoo.org/glsa/202401-30 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20231130-0004/ - () https://security.netapp.com/advisory/ntap-20231130-0004/ - Third Party Advisory
First Time Redhat enterprise Linux For Power Big Endian
Redhat enterprise Linux For Ibm Z Systems
Redhat enterprise Linux For Scientific Computing
Redhat enterprise Linux Server
Redhat enterprise Linux Desktop
Redhat enterprise Linux For Power Little Endian
Redhat enterprise Linux Workstation
CPE cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

31 Jan 2024, 13:15

Type Values Removed Values Added
References
  • () https://security.gentoo.org/glsa/202401-30 -

10 Jan 2024, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0128 -

02 Jan 2024, 15:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2024:0010 -

30 Nov 2023, 22:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20231130-0004/ -

28 Nov 2023, 18:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7533 -
  • () https://access.redhat.com/errata/RHSA-2023:7526 -

21 Nov 2023, 17:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:7428 -
  • () https://access.redhat.com/errata/RHSA-2023:7436 -
  • () https://access.redhat.com/errata/RHSA-2023:7373 -
  • () https://access.redhat.com/errata/RHSA-2023:7388 -
  • () https://access.redhat.com/errata/RHSA-2023:7405 -

18 Nov 2023, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/ -

17 Nov 2023, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/ -

13 Nov 2023, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/ -

10 Nov 2023, 02:15

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2023:6808 -
  • () https://access.redhat.com/errata/RHSA-2023:6802 -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/ -
  • () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/ -

06 Nov 2023, 03:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/ -

03 Nov 2023, 23:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/ -

02 Nov 2023, 17:21

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
CWE CWE-787
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
References (MISC) https://lists.x.org/archives/xorg-announce/2023-October/003430.html - (MISC) https://lists.x.org/archives/xorg-announce/2023-October/003430.html - Patch, Vendor Advisory
References (MISC) https://www.debian.org/security/2023/dsa-5534 - (MISC) https://www.debian.org/security/2023/dsa-5534 - Third Party Advisory
References (MISC) https://access.redhat.com/security/cve/CVE-2023-5367 - (MISC) https://access.redhat.com/security/cve/CVE-2023-5367 - Third Party Advisory
References (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2243091 - (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2243091 - Issue Tracking, Third Party Advisory
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/ - Mailing List
References (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/ - (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/ - Mailing List
First Time X.org xwayland
X.org
Fedoraproject fedora
Redhat
Redhat enterprise Linux
Debian debian Linux
Fedoraproject
X.org x Server
Debian

29 Oct 2023, 04:15

Type Values Removed Values Added
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/ -
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/ -

25 Oct 2023, 23:15

Type Values Removed Values Added
References
  • (MISC) https://www.debian.org/security/2023/dsa-5534 -

25 Oct 2023, 20:31

Type Values Removed Values Added
New CVE
Information

Published : 2023-10-25 20:15

Updated : 2024-02-16 15:33

NVD link : CVE-2023-5367

Mitre link : CVE-2023-5367

CVE.ORG link : CVE-2023-5367

JSON object : View

Products Affected

redhat

  • enterprise_linux_for_power_little_endian
  • enterprise_linux_desktop
  • enterprise_linux_for_ibm_z_systems
  • enterprise_linux
  • enterprise_linux_workstation
  • enterprise_linux_server
  • enterprise_linux_for_scientific_computing
  • enterprise_linux_for_power_big_endian

fedoraproject

  • fedora

debian

  • debian_linux

x.org

  • xwayland
  • x_server
CWE
CWE-787

Out-of-bounds Write