TI-2023-02940 Aliases CVE-2023-3138 GHSA-849h-8wj5-xmx8

Memory corruption in libX11

LOW 36CWE-119Published 2023-06-28 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.

Why it matters now

EPSS 0.01656 76th percentileScored 2026-11-07

Fix Partial Red Hat: 4 advisoriesRed Hat: 4 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	libX11	libX11 1.8.6	—	No fix listed	CNA

libX11 Vendor— Affected libX11 1.8.6 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:x.org:libx11::::::::	before 1.8.6	Vulnerable	x.org
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*	8.0	Vulnerable	Red Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*	9.0	Vulnerable	Red Hat

cpe:2.3:a:x.org:libx11:*:*:*:*:*:*:*:* Versions before 1.8.6 Vulnerable ·x.org
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat

Remediation

Red Hat 4 advisories

RHSA-2024:1417 Released 2024-03-19 · Red Hat rating Moderate
libX11 security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) libX11-1.6.8-6.el8_8, libX11-common-1.6.8-6.el8_8, libX11-devel-1.6.8-6.el8_8 +1
RHSA-2024:1088 Released 2024-03-05 · Red Hat rating Moderate
libX11 security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) libX11-1.7.0-8.el9_2, libX11-common-1.7.0-8.el9_2, libX11-devel-1.7.0-8.el9_2 +1
RHSA-2023:7029 Released 2023-11-14 · Red Hat rating Moderate
libX11 security update
- Red Hat Enterprise Linux AppStream (v. 8) libX11-1.6.8-6.el8, libX11-common-1.6.8-6.el8, libX11-devel-1.6.8-6.el8 +1

Show 1 more Red Hat advisories

RHSA-2023:6497 Released 2023-11-07 · Red Hat rating Moderate
libX11 security update
- Red Hat Enterprise Linux AppStream (v. 9) libX11-1.7.0-8.el9, libX11-common-1.7.0-8.el9, libX11-devel-1.7.0-8.el9 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2023:7029
Red Hat Enterprise Linux AppStream (v. 9)	Fixed	RHSA-2023:6497
Red Hat Enterprise Linux AppStream EUS (v.8.8)	Fixed	RHSA-2024:1417
Red Hat Enterprise Linux AppStream EUS (v.9.2)	Fixed	RHSA-2024:1088

Timeline

2026-10-02 Threatist record created from CVE-2023-3138
2026-10-03 Alias added: GHSA-849h-8wj5-xmx8

References

Patch 3

Advisory 1

https://access.redhat.com/security/cve/CVE-2023-3138

Other 1

https://security.netapp.com/advisory/ntap-20231208-0008/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences