CVE-2024-0409CWE-787
Xorg-x11-server: selinux context corruption
High · published January 18, 2024
What it is
A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
The record
Technical detail
- CVSS v3.1
- 7.8 · HIGH
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00356 · 28.1th percentile
- Weakness
- CWE-787 · Out-of-bounds Write
- Published
- 2024-01-18T15:40Z
EPSS history
Timeline