Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty
Priority LOW 35CWE-787Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 24 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.
Summary
A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00608 49th percentileScored 2026-11-07
Fix Partial Red Hat: 16 advisoriesRed Hat: 24 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | — | 1.1.0-25.el6_10.13 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | 1.20.4-24.el7_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | 1.8.0-26.el7_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 1.13.1-2.el8_9.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 1.20.11-22.el8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 21.1.3-15.el8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions | — | 1.9.0-16.el8_1.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | 1.9.0-15.el8_2.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Telecommunications Update Service | — | 1.9.0-15.el8_2.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | — | 1.9.0-15.el8_2.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 1.11.0-8.el8_4.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | 1.11.0-8.el8_4.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | 1.11.0-8.el8_4.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | 1.12.0-6.el8_6.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 1.12.0-15.el8_8.1 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.13.1-3.el9_3.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.20.11-24.el9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 22.1.9-5.el9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | — | 1.11.0-22.el9_0.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 1.12.0-14.el9_2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
- Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION VendorRed Hat Affected — Fixed in 1.1.0-25.el6_10.13 Patch available CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 1.20.4-24.el7_9 Patch available CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 1.8.0-26.el7_9 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.13.1-2.el8_9.1 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.20.11-22.el8 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 21.1.3-15.el8 Patch available CNA
- Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.9.0-16.el8_1.4 Patch available CNA
- Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 1.9.0-15.el8_2.4 Patch available CNA
- Red Hat Enterprise Linux 8.2 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.9.0-15.el8_2.4 Patch available CNA
- Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.9.0-15.el8_2.4 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.3 Patch available CNA
- Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.3 Patch available CNA
- Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.3 Patch available CNA
- Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 1.12.0-6.el8_6.4 Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 1.12.0-15.el8_8.1 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.13.1-3.el9_3.3 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.20.11-24.el9 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 22.1.9-5.el9 Patch available CNA
- Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 1.11.0-22.el9_0.3 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 1.12.0-14.el9_2 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* | before 21.1.9 | Vulnerable | x.org |
| cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* | before 23.2.2 | Vulnerable | x.org |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:* | 7.0_s390x | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:* | 7.0_ppc64 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:* | 7.0_ppc64le | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
- cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* Versions before 21.1.9 Vulnerable ·x.org
- cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* Versions before 23.2.2 Vulnerable ·x.org
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:* Versions 7.0_s390x Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:* Versions 7.0_ppc64 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:* Versions 7.0_ppc64le Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Debian |
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
Remediation
Red Hat 16 advisories
- RHSA-2025:12751 Released 2025-08-04 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) tigervnc-1.1.0-25.el6_10.13, tigervnc-server-1.1.0-25.el6_10.13
- Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) tigervnc-server-applet-1.1.0-25.el6_10.13, tigervnc-server-module-1.1.0-25.el6_10.13
- RHSA-2024:2996 Released 2024-05-22 · Red Hat rating Moderatexorg-x11-server-Xwayland security update
- Red Hat Enterprise Linux AppStream (v. 8) xorg-x11-server-Xwayland-21.1.3-15.el8
- RHSA-2024:2995 Released 2024-05-22 · Red Hat rating Moderatexorg-x11-server security update
- Red Hat Enterprise Linux AppStream (v. 8) xorg-x11-server-1.20.11-22.el8, xorg-x11-server-Xdmx-1.20.11-22.el8, xorg-x11-server-Xephyr-1.20.11-22.el8 +4
- Red Hat Enterprise Linux CRB (v. 8) xorg-x11-server-devel-1.20.11-22.el8, xorg-x11-server-source-1.20.11-22.el8
Show 13 more Red Hat advisories
- RHSA-2024:2169 Released 2024-04-30 · Red Hat rating Moderatexorg-x11-server security update
- Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-1.20.11-24.el9, xorg-x11-server-Xdmx-1.20.11-24.el9, xorg-x11-server-Xephyr-1.20.11-24.el9 +4
- Red Hat Enterprise Linux CRB (v. 9) xorg-x11-server-devel-1.20.11-24.el9, xorg-x11-server-source-1.20.11-24.el9
- RHSA-2024:2170 Released 2024-04-30 · Red Hat rating Moderatexorg-x11-server-Xwayland security update
- Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-Xwayland-22.1.9-5.el9
- RHSA-2024:0128 Released 2024-01-10 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream (v. 8) tigervnc-1.13.1-2.el8_9.1, tigervnc-icons-1.13.1-2.el8_9.1, tigervnc-license-1.13.1-2.el8_9.1 +4
- RHSA-2024:0010 Released 2024-01-02 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream (v. 9) tigervnc-1.13.1-3.el9_3.3, tigervnc-icons-1.13.1-3.el9_3.3, tigervnc-license-1.13.1-3.el9_3.3 +4
- RHSA-2023:7533 Released 2023-11-28 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) tigervnc-1.12.0-15.el8_8.1, tigervnc-icons-1.12.0-15.el8_8.1, tigervnc-license-1.12.0-15.el8_8.1 +4
- RHSA-2023:7526 Released 2023-11-28 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) tigervnc-1.11.0-8.el8_4.3, tigervnc-icons-1.11.0-8.el8_4.3, tigervnc-license-1.11.0-8.el8_4.3 +4
- Red Hat Enterprise Linux AppStream E4S (v.8.4) tigervnc-1.11.0-8.el8_4.3, tigervnc-icons-1.11.0-8.el8_4.3, tigervnc-license-1.11.0-8.el8_4.3 +4
- Red Hat Enterprise Linux AppStream TUS (v.8.4) tigervnc-1.11.0-8.el8_4.3, tigervnc-icons-1.11.0-8.el8_4.3, tigervnc-license-1.11.0-8.el8_4.3 +4
- RHSA-2023:7428 Released 2023-11-21 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux Client (v. 7) tigervnc-1.8.0-26.el7_9, tigervnc-icons-1.8.0-26.el7_9, tigervnc-license-1.8.0-26.el7_9 +2
- Red Hat Enterprise Linux Client Optional (v. 7) tigervnc-server-applet-1.8.0-26.el7_9, tigervnc-server-module-1.8.0-26.el7_9
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tigervnc-1.8.0-26.el7_9, tigervnc-icons-1.8.0-26.el7_9, tigervnc-server-1.8.0-26.el7_9 +2
- Red Hat Enterprise Linux Server (v. 7) tigervnc-1.8.0-26.el7_9, tigervnc-icons-1.8.0-26.el7_9, tigervnc-license-1.8.0-26.el7_9 +2
- Red Hat Enterprise Linux Server Optional (v. 7) tigervnc-server-applet-1.8.0-26.el7_9, tigervnc-server-module-1.8.0-26.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) tigervnc-1.8.0-26.el7_9, tigervnc-icons-1.8.0-26.el7_9, tigervnc-license-1.8.0-26.el7_9 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) tigervnc-server-applet-1.8.0-26.el7_9, tigervnc-server-module-1.8.0-26.el7_9
- RHSA-2023:7436 Released 2023-11-21 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) tigervnc-1.9.0-15.el8_2.4, tigervnc-icons-1.9.0-15.el8_2.4, tigervnc-license-1.9.0-15.el8_2.4 +4
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) tigervnc-1.9.0-15.el8_2.4, tigervnc-icons-1.9.0-15.el8_2.4, tigervnc-license-1.9.0-15.el8_2.4 +4
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) tigervnc-1.9.0-15.el8_2.4, tigervnc-icons-1.9.0-15.el8_2.4, tigervnc-license-1.9.0-15.el8_2.4 +4
- RHSA-2023:7405 Released 2023-11-21 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) tigervnc-1.12.0-6.el8_6.4, tigervnc-icons-1.12.0-6.el8_6.4, tigervnc-license-1.12.0-6.el8_6.4 +4
- RHSA-2023:7388 Released 2023-11-21 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) tigervnc-1.11.0-22.el9_0.3, tigervnc-icons-1.11.0-22.el9_0.3, tigervnc-license-1.11.0-22.el9_0.3 +4
- RHSA-2023:7373 Released 2023-11-21 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) tigervnc-1.12.0-14.el9_2, tigervnc-icons-1.12.0-14.el9_2, tigervnc-license-1.12.0-14.el9_2 +4
- RHSA-2023:6808 Released 2023-11-08 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream E4S (v. 8.1) tigervnc-1.9.0-16.el8_1.4, tigervnc-icons-1.9.0-16.el8_1.4, tigervnc-license-1.9.0-16.el8_1.4 +4
- RHSA-2023:6802 Released 2023-11-08 · Red Hat rating Importantxorg-x11-server security update
- Red Hat Enterprise Linux Client (v. 7) xorg-x11-server-1.20.4-24.el7_9, xorg-x11-server-Xephyr-1.20.4-24.el7_9, xorg-x11-server-Xorg-1.20.4-24.el7_9 +1
- Red Hat Enterprise Linux Client Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-24.el7_9, xorg-x11-server-Xnest-1.20.4-24.el7_9, xorg-x11-server-Xvfb-1.20.4-24.el7_9 +3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) xorg-x11-server-1.20.4-24.el7_9, xorg-x11-server-Xdmx-1.20.4-24.el7_9, xorg-x11-server-Xephyr-1.20.4-24.el7_9 +7
- Red Hat Enterprise Linux Server (v. 7) xorg-x11-server-1.20.4-24.el7_9, xorg-x11-server-Xephyr-1.20.4-24.el7_9, xorg-x11-server-Xorg-1.20.4-24.el7_9 +1
- Red Hat Enterprise Linux Server Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-24.el7_9, xorg-x11-server-Xnest-1.20.4-24.el7_9, xorg-x11-server-Xvfb-1.20.4-24.el7_9 +4
- Red Hat Enterprise Linux Workstation (v. 7) xorg-x11-server-1.20.4-24.el7_9, xorg-x11-server-Xephyr-1.20.4-24.el7_9, xorg-x11-server-Xorg-1.20.4-24.el7_9 +1
- Red Hat Enterprise Linux Workstation Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-24.el7_9, xorg-x11-server-Xnest-1.20.4-24.el7_9, xorg-x11-server-Xvfb-1.20.4-24.el7_9 +3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 and 2 more products — RHSA-2023:7428
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2023-04951 Xorg-x11-server: use-after-free bug in destroywindowPriority LOW 23
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0128, RHSA-2024:2995, RHSA-2024:2996 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:0010, RHSA-2024:2169, RHSA-2024:2170 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2023:7436 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2023:7526 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.1) | Fixed | RHSA-2023:6808 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Fixed | RHSA-2023:7436 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2023:7526 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2023:7405 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2023:7533 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2023:7388 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2023:7373 |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Fixed | RHSA-2023:7436 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2023:7526 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2024:2995 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2024:2169 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2023:6802, RHSA-2023:7428 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2023:6802, RHSA-2023:7428 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2023:6802, RHSA-2023:7428 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2023:6802, RHSA-2023:7428 |
| Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) | Fixed | RHSA-2025:12751 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2023:6802, RHSA-2023:7428 |
| Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) | Fixed | RHSA-2025:12751 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2023:6802, RHSA-2023:7428 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2023:6802, RHSA-2023:7428 |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-5367
- 2026-10-03 Alias added: GHSA-q38f-wwqq-rr3v
References
Advisory 18
More Red Hat Enterprise Linux vulnerabilities
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2018-10530 Code injection in [UNKNOWN] RichFaces KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
- TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-23530 Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf… KEVCVSS 3.1CRITICAL 9.3
- TI-2021-17490 mod_proxy SSRF KEVCVSS 3.1CRITICAL 9.0
Sources
- CVE-2023-5367 · CVE Program
- CVE-2023-5367 · NVD
- FIRST EPSS
- GHSA-q38f-wwqq-rr3v · GitHub Advisory Database · CC BY 4.0
- CVE-2023-5367 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences