CVE-2023-6478

Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty

HIGH

7.5

CVSS Score

Published: December 13, 2023 at 06:27 AM UTC

Updated: June 23, 2026 at 06:17 PM UTC

6 products affected across 4 vendorsDebian LinuxEnterprise Linux EusX server

Using Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION by Red Hat?

Get instant alerts when new vulnerabilities affect Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 2%

SSVC

No known exploit

Description

A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

10.0 11.0 12.0

Enterprise Linux Eus · Red Hatrpm

95%

9.2

Tigervnc · Tigervnc

95%

All versions

redhat-enterprise-linux (environment)

X server · X Org

95%

v < 21.1.10

Affected range stops below 21.1.10, so it looks safe — our inference, not a vendor statement

redhat-enterprise-linux (environment)

Xwayland · X Org

95%

v < 23.2.3

Affected range stops below 23.2.3, so it looks safe — our inference, not a vendor statement

redhat-enterprise-linux (environment)

Enterprise Linux · Red Hatrpmdevice

80%

All versions

Vendor states this is fixed in 0:1.1.0-25.el6_10.13 (unaffected)

Vendor states this is fixed in 0:1.11.0-22.el9_0.5 (unaffected)

Vendor states this is fixed in 0:1.11.0-8.el8_4.5 (unaffected)

Vendor states this is fixed in 0:1.12.0-14.el9_2.2 (unaffected)

Vendor states this is fixed in 0:1.12.0-15.el8_8.4 (unaffected)

Vendor states this is fixed in 0:1.12.0-6.el8_6.6 (unaffected)

Vendor states this is fixed in 0:1.13.1-2.el8_9.4 (unaffected)

Vendor states this is fixed in 0:1.13.1-3.el9_3.3 (unaffected)

Vendor states this is fixed in 0:1.20.11-22.el8 (unaffected)

Vendor states this is fixed in 0:1.20.11-24.el9 (unaffected)

Vendor states this is fixed in 0:1.20.4-25.el7_9 (unaffected)

Vendor states this is fixed in 0:1.8.0-28.el7_9 (unaffected)

Vendor states this is fixed in 0:1.9.0-15.el8_2.6 (unaffected)

Vendor states this is fixed in 0:21.1.3-15.el8 (unaffected)

Vendor states this is fixed in 0:22.1.9-5.el9 (unaffected)

Vendor states this is fixed in 6 (unknown)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references