CoreCVE
Back

CRITICAL

Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer

Published Jan 18, 2024

Description

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

Affected products

Remediation

Vendor solution

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Red Hat statement

The Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9, therefore, Red Hat Enterprise Linux 8 and 9 have been rated with a moderate severity.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

Weaknesses (1)

CWE-787

Out-of-bounds Write

References (26)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Jan 18, 2024
Updated Mar 19, 2026
Reserved Dec 14, 2023
Link CVE-2023-6816
CISA Vulnrichment
Updated Jan 18, 2024
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2023-6816
Red Hat
Severity Important
Public date Jan 16, 2024
Links CVE-2023-6816 - Bugzilla