Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty
Priority MEDIUM 43CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · Low
- Fix status
- Partial Red Hat: 23 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01617 76th percentileScored 2026-11-07
Fix Partial Red Hat: 15 advisoriesRed Hat: 23 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | — | 1.1.0-25.el6_10.13 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | 1.8.0-28.el7_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | 1.20.4-25.el7_9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 1.13.1-2.el8_9.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 1.20.11-22.el8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | 21.1.3-15.el8 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | — | 1.9.0-15.el8_2.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Telecommunications Update Service | — | 1.9.0-15.el8_2.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions | — | 1.9.0-15.el8_2.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | 1.11.0-8.el8_4.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | 1.11.0-8.el8_4.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | 1.11.0-8.el8_4.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support | — | 1.12.0-6.el8_6.6 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | 1.12.0-15.el8_8.4 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.13.1-3.el9_3.3 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 1.20.11-24.el9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 22.1.9-5.el9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.0 Extended Update Support | — | 1.11.0-22.el9_0.5 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | 1.12.0-14.el9_2.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | No fix listed | CNA |
- Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION VendorRed Hat Affected — Fixed in 1.1.0-25.el6_10.13 Patch available CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 1.8.0-28.el7_9 Patch available CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in 1.20.4-25.el7_9 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.13.1-2.el8_9.4 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 1.20.11-22.el8 Patch available CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 21.1.3-15.el8 Patch available CNA
- Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 1.9.0-15.el8_2.6 Patch available CNA
- Red Hat Enterprise Linux 8.2 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.9.0-15.el8_2.6 Patch available CNA
- Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.9.0-15.el8_2.6 Patch available CNA
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.5 Patch available CNA
- Red Hat Enterprise Linux 8.4 Telecommunications Update Service VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.5 Patch available CNA
- Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.11.0-8.el8_4.5 Patch available CNA
- Red Hat Enterprise Linux 8.6 Extended Update Support VendorRed Hat Affected — Fixed in 1.12.0-6.el8_6.6 Patch available CNA
- Red Hat Enterprise Linux 8.8 Extended Update Support VendorRed Hat Affected — Fixed in 1.12.0-15.el8_8.4 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.13.1-3.el9_3.3 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.20.11-24.el9 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 22.1.9-5.el9 Patch available CNA
- Red Hat Enterprise Linux 9.0 Extended Update Support VendorRed Hat Affected — Fixed in 1.11.0-22.el9_0.5 Patch available CNA
- Red Hat Enterprise Linux 9.2 Extended Update Support VendorRed Hat Affected — Fixed in 1.12.0-14.el9_2.2 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* | before 21.1.10 | Vulnerable | x.org |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Running on | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Running on | Red Hat |
| cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* | before 23.2.3 | Vulnerable | x.org |
| cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* | 9.2 | Vulnerable | Red Hat |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* | 12.0 | Vulnerable | Debian |
- cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* Versions before 21.1.10 Vulnerable ·x.org
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Running on ·Red Hat
- cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* Versions before 23.2.3 Vulnerable ·x.org
- cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* Versions 9.2 Vulnerable ·Red Hat
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian
Remediation
Red Hat 15 advisories
- RHSA-2025:12751 Released 2025-08-04 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) tigervnc-1.1.0-25.el6_10.13, tigervnc-server-1.1.0-25.el6_10.13
- Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) tigervnc-server-applet-1.1.0-25.el6_10.13, tigervnc-server-module-1.1.0-25.el6_10.13
- RHSA-2024:2996 Released 2024-05-22 · Red Hat rating Moderatexorg-x11-server-Xwayland security update
- Red Hat Enterprise Linux AppStream (v. 8) xorg-x11-server-Xwayland-21.1.3-15.el8
- RHSA-2024:2995 Released 2024-05-22 · Red Hat rating Moderatexorg-x11-server security update
- Red Hat Enterprise Linux AppStream (v. 8) xorg-x11-server-1.20.11-22.el8, xorg-x11-server-Xdmx-1.20.11-22.el8, xorg-x11-server-Xephyr-1.20.11-22.el8 +4
- Red Hat Enterprise Linux CRB (v. 8) xorg-x11-server-devel-1.20.11-22.el8, xorg-x11-server-source-1.20.11-22.el8
Show 12 more Red Hat advisories
- RHSA-2024:2169 Released 2024-04-30 · Red Hat rating Moderatexorg-x11-server security update
- Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-1.20.11-24.el9, xorg-x11-server-Xdmx-1.20.11-24.el9, xorg-x11-server-Xephyr-1.20.11-24.el9 +4
- Red Hat Enterprise Linux CRB (v. 9) xorg-x11-server-devel-1.20.11-24.el9, xorg-x11-server-source-1.20.11-24.el9
- RHSA-2024:2170 Released 2024-04-30 · Red Hat rating Moderatexorg-x11-server-Xwayland security update
- Red Hat Enterprise Linux AppStream (v. 9) xorg-x11-server-Xwayland-22.1.9-5.el9
- RHSA-2024:0018 Released 2024-01-02 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream (v. 8) tigervnc-1.13.1-2.el8_9.4, tigervnc-icons-1.13.1-2.el8_9.4, tigervnc-license-1.13.1-2.el8_9.4 +4
- RHSA-2024:0015 Released 2024-01-02 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream EUS (v.8.6) tigervnc-1.12.0-6.el8_6.6, tigervnc-icons-1.12.0-6.el8_6.6, tigervnc-license-1.12.0-6.el8_6.6 +4
- RHSA-2024:0016 Released 2024-01-02 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream AUS (v.8.4) tigervnc-1.11.0-8.el8_4.5, tigervnc-icons-1.11.0-8.el8_4.5, tigervnc-license-1.11.0-8.el8_4.5 +4
- Red Hat Enterprise Linux AppStream E4S (v.8.4) tigervnc-1.11.0-8.el8_4.5, tigervnc-icons-1.11.0-8.el8_4.5, tigervnc-license-1.11.0-8.el8_4.5 +4
- Red Hat Enterprise Linux AppStream TUS (v.8.4) tigervnc-1.11.0-8.el8_4.5, tigervnc-icons-1.11.0-8.el8_4.5, tigervnc-license-1.11.0-8.el8_4.5 +4
- RHSA-2024:0020 Released 2024-01-02 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream EUS (v.9.0) tigervnc-1.11.0-22.el9_0.5, tigervnc-icons-1.11.0-22.el9_0.5, tigervnc-license-1.11.0-22.el9_0.5 +4
- RHSA-2024:0010 Released 2024-01-02 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream (v. 9) tigervnc-1.13.1-3.el9_3.3, tigervnc-icons-1.13.1-3.el9_3.3, tigervnc-license-1.13.1-3.el9_3.3 +4
- RHSA-2024:0014 Released 2024-01-02 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream EUS (v.8.8) tigervnc-1.12.0-15.el8_8.4, tigervnc-icons-1.12.0-15.el8_8.4, tigervnc-license-1.12.0-15.el8_8.4 +4
- RHSA-2024:0006 Released 2024-01-02 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux Client (v. 7) tigervnc-1.8.0-28.el7_9, tigervnc-icons-1.8.0-28.el7_9, tigervnc-license-1.8.0-28.el7_9 +2
- Red Hat Enterprise Linux Client Optional (v. 7) tigervnc-server-applet-1.8.0-28.el7_9, tigervnc-server-module-1.8.0-28.el7_9
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) tigervnc-1.8.0-28.el7_9, tigervnc-icons-1.8.0-28.el7_9, tigervnc-server-1.8.0-28.el7_9 +2
- Red Hat Enterprise Linux Server (v. 7) tigervnc-1.8.0-28.el7_9, tigervnc-icons-1.8.0-28.el7_9, tigervnc-license-1.8.0-28.el7_9 +2
- Red Hat Enterprise Linux Server Optional (v. 7) tigervnc-server-applet-1.8.0-28.el7_9, tigervnc-server-module-1.8.0-28.el7_9
- Red Hat Enterprise Linux Workstation (v. 7) tigervnc-1.8.0-28.el7_9, tigervnc-icons-1.8.0-28.el7_9, tigervnc-license-1.8.0-28.el7_9 +2
- Red Hat Enterprise Linux Workstation Optional (v. 7) tigervnc-server-applet-1.8.0-28.el7_9, tigervnc-server-module-1.8.0-28.el7_9
- RHSA-2024:0017 Released 2024-01-02 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream AUS (v. 8.2) tigervnc-1.9.0-15.el8_2.6, tigervnc-icons-1.9.0-15.el8_2.6, tigervnc-license-1.9.0-15.el8_2.6 +4
- Red Hat Enterprise Linux AppStream E4S (v. 8.2) tigervnc-1.9.0-15.el8_2.6, tigervnc-icons-1.9.0-15.el8_2.6, tigervnc-license-1.9.0-15.el8_2.6 +4
- Red Hat Enterprise Linux AppStream TUS (v. 8.2) tigervnc-1.9.0-15.el8_2.6, tigervnc-icons-1.9.0-15.el8_2.6, tigervnc-license-1.9.0-15.el8_2.6 +4
- RHSA-2024:0009 Released 2024-01-02 · Red Hat rating Importantxorg-x11-server security update
- Red Hat Enterprise Linux Client (v. 7) xorg-x11-server-1.20.4-25.el7_9, xorg-x11-server-Xephyr-1.20.4-25.el7_9, xorg-x11-server-Xorg-1.20.4-25.el7_9 +1
- Red Hat Enterprise Linux Client Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-25.el7_9, xorg-x11-server-Xnest-1.20.4-25.el7_9, xorg-x11-server-Xvfb-1.20.4-25.el7_9 +3
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) xorg-x11-server-1.20.4-25.el7_9, xorg-x11-server-Xdmx-1.20.4-25.el7_9, xorg-x11-server-Xephyr-1.20.4-25.el7_9 +7
- Red Hat Enterprise Linux Server (v. 7) xorg-x11-server-1.20.4-25.el7_9, xorg-x11-server-Xephyr-1.20.4-25.el7_9, xorg-x11-server-Xorg-1.20.4-25.el7_9 +1
- Red Hat Enterprise Linux Server Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-25.el7_9, xorg-x11-server-Xnest-1.20.4-25.el7_9, xorg-x11-server-Xvfb-1.20.4-25.el7_9 +4
- Red Hat Enterprise Linux Workstation (v. 7) xorg-x11-server-1.20.4-25.el7_9, xorg-x11-server-Xephyr-1.20.4-25.el7_9, xorg-x11-server-Xorg-1.20.4-25.el7_9 +1
- Red Hat Enterprise Linux Workstation Optional (v. 7) xorg-x11-server-Xdmx-1.20.4-25.el7_9, xorg-x11-server-Xnest-1.20.4-25.el7_9, xorg-x11-server-Xvfb-1.20.4-25.el7_9 +3
- RHSA-2023:7886 Released 2023-12-20 · Red Hat rating Importanttigervnc security update
- Red Hat Enterprise Linux AppStream EUS (v.9.2) tigervnc-1.12.0-14.el9_2.2, tigervnc-icons-1.12.0-14.el9_2.2, tigervnc-license-1.12.0-14.el9_2.2 +4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 13 more products — RHSA-2023:7886
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-05853 Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actionsPriority LOW 39
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 13 more products — RHSA-2024:0006
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-05853 Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actionsPriority LOW 39
Show 7 more groups
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 13 more products — RHSA-2024:0009
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-05853 Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actionsPriority LOW 39
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 13 more products — RHSA-2024:0014
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-05853 Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actionsPriority LOW 39
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 13 more products — RHSA-2024:0015
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-05853 Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actionsPriority LOW 39
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 13 more products — RHSA-2024:0016
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-05853 Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actionsPriority LOW 39
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 13 more products — RHSA-2024:0017
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-05853 Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actionsPriority LOW 39
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 13 more products — RHSA-2024:0018
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-05853 Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actionsPriority LOW 39
- Advisory ·
Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION and 13 more products — RHSA-2024:0020
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2023-05853 Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actionsPriority LOW 39
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2024:0018, RHSA-2024:2995, RHSA-2024:2996 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:0010, RHSA-2024:2169, RHSA-2024:2170 |
| Red Hat Enterprise Linux AppStream AUS (v. 8.2) | Fixed | RHSA-2024:0017 |
| Red Hat Enterprise Linux AppStream AUS (v.8.4) | Fixed | RHSA-2024:0016 |
| Red Hat Enterprise Linux AppStream E4S (v. 8.2) | Fixed | RHSA-2024:0017 |
| Red Hat Enterprise Linux AppStream E4S (v.8.4) | Fixed | RHSA-2024:0016 |
| Red Hat Enterprise Linux AppStream EUS (v.8.6) | Fixed | RHSA-2024:0015 |
| Red Hat Enterprise Linux AppStream EUS (v.8.8) | Fixed | RHSA-2024:0014 |
| Red Hat Enterprise Linux AppStream EUS (v.9.0) | Fixed | RHSA-2024:0020 |
| Red Hat Enterprise Linux AppStream EUS (v.9.2) | Fixed | RHSA-2023:7886 |
| Red Hat Enterprise Linux AppStream TUS (v. 8.2) | Fixed | RHSA-2024:0017 |
| Red Hat Enterprise Linux AppStream TUS (v.8.4) | Fixed | RHSA-2024:0016 |
| Red Hat Enterprise Linux CRB (v. 8) | Fixed | RHSA-2024:2995 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2024:2169 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2024:0006, RHSA-2024:0009 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2024:0006, RHSA-2024:0009 |
| Red Hat Enterprise Linux ComputeNode Optional (v. 7) | Fixed | RHSA-2024:0006, RHSA-2024:0009 |
| Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2024:0006, RHSA-2024:0009 |
| Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) | Fixed | RHSA-2025:12751 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2024:0006, RHSA-2024:0009 |
| Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) | Fixed | RHSA-2025:12751 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2024:0006, RHSA-2024:0009 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2024:0006, RHSA-2024:0009 |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-6478
- 2026-10-03 Alias added: GHSA-fwrj-5c8f-f8h2
References
Patch 1
Advisory 17
- RHSA-2023:7886
- RHSA-2024:0006
- RHSA-2024:0009
- RHSA-2024:0010
- RHSA-2024:0014
- RHSA-2024:0015
- RHSA-2024:0016
- RHSA-2024:0017
- RHSA-2024:0018
- RHSA-2024:0020
- RHSA-2024:2169
- RHSA-2024:2170
- RHSA-2024:2995
- RHSA-2024:2996
- RHSA-2025:12751
- https://access.redhat.com/security/cve/CVE-2023-6478
- https://lists.x.org/archives/xorg-announce/2023-December/003435.html
Other 1
More Red Hat Enterprise Linux Eus vulnerabilities
- TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
- TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-02747 Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-02679 Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-02278 Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-6478 · CVE Program
- CVE-2023-6478 · NVD
- FIRST EPSS
- GHSA-fwrj-5c8f-f8h2 · GitHub Advisory Database · CC BY 4.0
- CVE-2023-6478 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences