CVE-2023-6478
HIGH EPSS 73.2%
Published Dec 13, 20232y ago · Modified Jun 23, 20266d ago
7.5 CVSS 3.1
Published Dec 13, 2023 2y ago
Last Modified Jun 23, 2026 6d ago
Description
A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity None
Availability None
Threat Intelligence
EPSS Exploit Probability
73.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 1
CWE-190 Integer Overflow or Wraparound Numeric Error
Affected Products 17
| Vendor | Product | Version | Range |
|---|---|---|---|
| x.org | x_server | * | <21.1.10 |
| redhat | enterprise_linux | 6.0 | any |
| redhat | enterprise_linux | 7.0 | any |
| redhat | enterprise_linux | 8.0 | any |
| redhat | enterprise_linux | 9.0 | any |
| x.org | xwayland | * | <23.2.3 |
| redhat | enterprise_linux | 8.0 | any |
| redhat | enterprise_linux | 9.0 | any |
| redhat | enterprise_linux_eus | 9.2 | any |
| debian | debian_linux | 10.0 | any |
| debian | debian_linux | 11.0 | any |
| debian | debian_linux | 12.0 | any |
| tigervnc | tigervnc | * | any |
| redhat | enterprise_linux | 6.0 | any |
| redhat | enterprise_linux | 7.0 | any |
| redhat | enterprise_linux | 8.0 | any |
| redhat | enterprise_linux | 9.0 | any |
References 28
- openwall.com http://www.openwall.com/lists/oss-security/2023/12/13/1
- access.redhat.com https://access.redhat.com/errata/RHSA-2023:7886
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:0006
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:0009
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:0010
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:0014
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:0015
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:0016
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:0017
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:0018
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:0020
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:2169
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:2170
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:2995
- access.redhat.com https://access.redhat.com/errata/RHSA-2024:2996
- access.redhat.com https://access.redhat.com/errata/RHSA-2025:12751
- access.redhat.com https://access.redhat.com/security/cve/CVE-2023-6478
- bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2253298
- gitlab.freedesktop.org https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632
- lists.debian.org https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R63Z6GIWM3YUNZRCGFODUXLW3GY2HD6/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PP47YXKM5ETLCYEF6473R3VFCJ6QT2S/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFHV5KCQ2SVOD4QMCPZ5HC6YL44L7YJD/
- lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/
- lists.x.org https://lists.x.org/archives/xorg-announce/2023-December/003435.html
- security.gentoo.org https://security.gentoo.org/glsa/202401-30
- security.netapp.com https://security.netapp.com/advisory/ntap-20240125-0003/
- debian.org https://www.debian.org/security/2023/dsa-5576
Remediation
- gitlab.freedesktop.org https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632