PT-2023-3418 · Libx11+9 · Libx11+9
Alan Coopersmith
·
Published
2023-06-15
·
Updated
2026-05-07
·
CVE-2023-3138
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libX11 versions prior to 1.8.6
Description
A security flaw was found in libX11 due to functions in src/InitExt.c not checking if the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to. This can lead to memory corruption, potentially causing the client to crash, if a malicious server or proxy-in-the-middle provides out-of-bounds values. The issue is related to buffer overflows in InitExt.c.
Recommendations
For libX11 versions prior to 1.8.6, update to version 1.8.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable
src/InitExt.c functions until a patch is available. Avoid using the Request, Event, or Error IDs in the affected API endpoints until the issue is resolved.Fix
Memory Corruption
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Linuxmint
Red Hat
Red Os
Suse
Ubuntu
Libx11