PT-2024-13306 · Libglvnd+2 · Libglvnd+2

Meng Ruijie · Published 2024-03-26 · Updated 2024-08-06 · CVE-2023-45924

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenGL libglvnd version bb06db5a

Description A segmentation violation was discovered in the libglxproto.c file of OpenGL libglvnd via the glXGetDrawableScreen() function. This issue is disputed as there are no common situations where users require uninterrupted operation with an attacker-controlled server.

Recommendations For version bb06db5a, as a temporary workaround, consider restricting the use of the glXGetDrawableScreen() function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Stack Overflow

Weakness Enumeration

CWE-476

CWE-121

Related Identifiers

CVE-2023-45924

Affected Products

Debian

Red Os

Libglvnd

References · 16

• https://osv.dev/vulnerability/UBUNTU-CVE-2023-45924 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-45924 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-45924 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2023-45924 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45924 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2023-45924 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-libglvnd-cve-2023-45924 · Note
• https://t.me/cvenotify/84965 · Telegram Post
• https://t.me/cvenotify/74775 · Telegram Post
• https://t.me/cvenotify/84534 · Telegram Post
• https://gitlab.freedesktop.org/glvnd/libglvnd/-/issues/242 · Note
• http://seclists.org/fulldisclosure/2024/Jan/52 · Note
• https://gitlab.freedesktop.org/glvnd/libglvnd/-/merge_requests/295 · Note
• https://twitter.com/CVEnew/status/1772845887653380544 · Twitter Post