PT-2023-3418 · Libx11+9 · Libx11+9
Alan Coopersmith
·
Publicado
2023-06-15
·
Atualizado
2026-05-07
·
CVE-2023-3138
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libX11 versions prior to 1.8.6
Description
A security flaw was found in libX11 due to functions in src/InitExt.c not checking if the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to. This can lead to memory corruption, potentially causing the client to crash, if a malicious server or proxy-in-the-middle provides out-of-bounds values. The issue is related to buffer overflows in InitExt.c.
Recommendations
For libX11 versions prior to 1.8.6, update to version 1.8.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable
src/InitExt.c functions until a patch is available. Avoid using the Request, Event, or Error IDs in the affected API endpoints until the issue is resolved.Correção
Memory Corruption
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Suse
Ubuntu
Libx11