Vulnerabilities > CVE-2024-0409 - Out-of-bounds Write vulnerability in multiple products
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
References
- https://access.redhat.com/security/cve/CVE-2024-0409
- https://bugzilla.redhat.com/show_bug.cgi?id=2257690
- https://lists.fedoraproject.org/archives/list/[email protected]/message/5J4H7CH565ALSZZYKOJFYDA5KFLG6NUK/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/EJBMCWQ54R6ZL3MYU2D2JBW6JMZL7BQW/
- https://access.redhat.com/errata/RHSA-2024:0320
- https://lists.debian.org/debian-lts-announce/2024/01/msg00016.html
- https://security.gentoo.org/glsa/202401-30
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IZ75X54CN4IFYMIV7OK3JVZ57FHQIGIC/
- https://security.netapp.com/advisory/ntap-20240307-0006/