A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
22 May 2024, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Apr 2024, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
07 Mar 2024, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
09 Feb 2024, 02:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
31 Jan 2024, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
30 Jan 2024, 23:03
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Redhat enterprise Linux Workstation
Fedoraproject fedora Tigervnc tigervnc Redhat enterprise Linux For Power Little Endian Redhat enterprise Linux Fedoraproject X.org xwayland Redhat enterprise Linux For Scientific Computing Redhat enterprise Linux For Power Big Endian Redhat enterprise Linux Desktop Redhat enterprise Linux Server X.org xorg-server X.org Redhat Redhat enterprise Linux For Ibm Z Systems Tigervnc |
|
| References | () https://access.redhat.com/errata/RHSA-2024:0320 - Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2024-0409 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2257690 - Issue Tracking, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2024/01/msg00016.html - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5J4H7CH565ALSZZYKOJFYDA5KFLG6NUK/ - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EJBMCWQ54R6ZL3MYU2D2JBW6JMZL7BQW/ - Mailing List, Third Party Advisory | |
| CPE | cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* cpe:2.3:a:x.org:xorg-server:*:*:*:*:*:*:*:* cpe:2.3:a:tigervnc:tigervnc:*:*:*:*:*:*:*:* cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
25 Jan 2024, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
22 Jan 2024, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
22 Jan 2024, 03:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-18 16:15
Updated : 2024-05-22 17:16
NVD link : CVE-2024-0409
Mitre link : CVE-2024-0409
CVE.ORG link : CVE-2024-0409
JSON object : View
Products Affected
fedoraproject
- fedora
redhat
- enterprise_linux_server
- enterprise_linux
- enterprise_linux_desktop
- enterprise_linux_for_power_little_endian
- enterprise_linux_for_power_big_endian
- enterprise_linux_workstation
- enterprise_linux_for_ibm_z_systems
- enterprise_linux_for_scientific_computing
x.org
- xwayland
- xorg-server
tigervnc
- tigervnc
CWE
CWE-787
Out-of-bounds Write