Published: 18/01/2024 Updated: 07/03/2024

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 0

A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.

Vulnerable Product	Search on Vulmon	Subscribe to Product
x.org xwayland
x.org xorg-server
tigervnc tigervnc
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux for scientific computing 7.0
redhat enterprise linux 7.0
redhat enterprise linux 6.0
redhat enterprise linux server 7.0
redhat enterprise linux for power little endian 7.0
redhat enterprise linux for power big endian 7.0
redhat enterprise linux for ibm z systems 7.0
redhat enterprise linux 8.0
redhat enterprise linux 9.0
fedoraproject fedora 39

Synopsis Important: xorg-x11-server security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for xorg-x11-server is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this upd ...

Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer NOTE: listsxorg/archives/xorg/2024-January/061525htmlNOTE: gitlabfreedesktoporg/xorg/xserver/-/commit/9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 (CVE-2023-6816) Reattaching to different master device may lead to out-of-bounds memory access NOTE: listsxorg/a ...

DescriptionA flaw was found in the XOrg server The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try ...

NVD-CWE-Other https://access.redhat.com/security/cve/CVE-2024-0408 https://bugzilla.redhat.com/show_bug.cgi?id=2257689 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5J4H7CH565ALSZZYKOJFYDA5KFLG6NUK/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EJBMCWQ54R6ZL3MYU2D2JBW6JMZL7BQW/https://access.redhat.com/errata/RHSA-2024:0320 https://lists.debian.org/debian-lts-announce/2024/01/msg00016.html https://security.gentoo.org/glsa/202401-30 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IZ75X54CN4IFYMIV7OK3JVZ57FHQIGIC/https://security.netapp.com/advisory/ntap-20240307-0006/https://access.redhat.com/errata/RHSA-2024:0320 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALAS-2024-2455.html

CVE-2024-0408

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect