CVE-2023-6377
HighCVSS 7.8Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
A flaw was found in xorg-server that allows for out-of-bounds memory reads and writes when querying or changing XKB button actions, such as moving from a touchpad to a mouse. This may lead to local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.
Risk Assessment
This vulnerability poses a risk of privilege escalation, potentially allowing unauthorized access to the system. The risk of remote code execution also increases if X11 forwarding is actively used.
Recommendation
It is recommended to update xorg-server to the latest version to mitigate this vulnerability. Additionally, consider limiting the use of X11 forwarding in environments where feasible.
Other vulnerabilities in xorg-server
See all- CVE-2026-56000High
A vulnerability in Xorg server and Xwayland allows local attackers with an X connection to trigger a Heap Use-After-Free via the CommonMakeCurrent() function, which may point to potentially reallocated memory.
- CVE-2026-55999High
A vulnerability in Xorg server and Xwayland before versions 21.2.24 and 24.1.13 allows local attackers with an X connection to cause a heap buffer overflow via the SetFont function using crafted PCX fonts. Missing glyph boundary checks lead to buffer overflow.
- CVE-2023-6478High
A flaw was found in xorg-server that can be triggered by a specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty. This may lead to an integer overflow, potentially resulting in the disclosure of sensitive information.
Original NVD description (English source)
A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.