CVE-2023-5367

HIGH EPSS 45.2%

Published Oct 25, 20232y ago · Modified Jun 23, 20261w ago

7.8 CVSS 3.1

High

Published Oct 25, 2023 2y ago

Last Modified Jun 23, 2026 1w ago

Description

A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.

CVSS Details

Base Score

7.8

Exploitability

1.8

Impact

5.9

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

45.2% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-787 Out-of-bounds Write Memory Safety

Affected Products 17

Vendor	Product	Version	Range
x.org	x_server	*	<21.1.9
x.org	xwayland	*	<23.2.2
redhat	enterprise_linux	7.0	any
redhat	enterprise_linux	8.0	any
redhat	enterprise_linux	9.0	any
redhat	enterprise_linux_desktop	7.0	any
redhat	enterprise_linux_for_ibm_z_systems	7.0_s390x	any
redhat	enterprise_linux_for_power_big_endian	7.0_ppc64	any
redhat	enterprise_linux_for_power_little_endian	7.0_ppc64le	any
redhat	enterprise_linux_for_scientific_computing	7.0	any
redhat	enterprise_linux_server	7.0	any
redhat	enterprise_linux_workstation	7.0	any
fedoraproject	fedora	37	any
fedoraproject	fedora	38	any
fedoraproject	fedora	39	any
debian	debian_linux	11.0	any
debian	debian_linux	12.0	any

References 32

access.redhat.com https://access.redhat.com/errata/RHSA-2023:6802

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:6808

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:7373

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:7388

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:7405

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:7428

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:7436

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:7526

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2023:7533

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2024:0010

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2024:0128

Third Party Advisory
access.redhat.com https://access.redhat.com/errata/RHSA-2024:2169
access.redhat.com https://access.redhat.com/errata/RHSA-2024:2170
access.redhat.com https://access.redhat.com/errata/RHSA-2024:2995
access.redhat.com https://access.redhat.com/errata/RHSA-2024:2996
access.redhat.com https://access.redhat.com/errata/RHSA-2025:12751
access.redhat.com https://access.redhat.com/security/cve/CVE-2023-5367

Third Party Advisory
bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2243091

Issue TrackingThird Party Advisory
lists.debian.org https://lists.debian.org/debian-lts-announce/2023/10/msg00036.html
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4YBK3I6SETHETBHDETFWM3VSZUQICIDV/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L2RMNR4235YXZZQ2X7Q4MTOZDMZ7BBQU/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SEDJN4VFN57K5POOC7BNVD6L6WUUCSG6/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/
lists.x.org https://lists.x.org/archives/xorg-announce/2023-October/003430.html

PatchVendor Advisory
security.gentoo.org https://security.gentoo.org/glsa/202401-30
security.netapp.com https://security.netapp.com/advisory/ntap-20231130-0004/
debian.org https://www.debian.org/security/2023/dsa-5534

Remediation

lists.x.org https://lists.x.org/archives/xorg-announce/2023-October/003430.html

PatchVendor Advisory