Integer overflow in libx11 - CVE-2023-43787

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU81434

Integer overflow in libx11 - CVE-2023-43787

Published: October 3, 2023


Vulnerability identifier: #VU81434
CSH Severity: Low
CVSS v4 BT: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2023-43787
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to integer overflow within the XCreateImage() function. A local user can trigger integer overflow and execute arbitrary code with elevated privileges.



Affected software

libx11
Cloud Pak for Network Automation
Platform Automation Toolkit
Enterprise SONiC
IBM Cloud Pak for Watson AIOps
Amazon Linux AMI
Gentoo Linux
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Linux Enterprise Micro for Rancher
SUSE Linux Enterprise Micro
OpenBSD
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Slackware Linux
Ubuntu
Basesystem Module
openSUSE Leap
openEuler
Data Lakehouse
Migration Toolkit for Runtimes
Isolation Segment
VMware Tanzu Application Service for VMs
Red Hat OpenShift Dev Spaces
App Connect Enterprise Certified Container
Red Hat Migration Toolkit for Applications
RecoverPoint for Virtual Machines
libxpm4 (Ubuntu package)
libx11-6 (Ubuntu package)
libX11
libX11-6-32bit
libX11-xcb1-debuginfo-32bit
libX11-xcb1-32bit
libX11-6-debuginfo-32bit
libX11-data
libX11-xcb1
libX11-6
libX11-xcb1-debuginfo
libX11-6-debuginfo
libX11-devel
libX11-debugsource
libX11-xcb1-32bit-debuginfo
libX11-devel-32bit
libX11-6-32bit-debuginfo
libX11 (Red Hat package)
libX11-help
libX11-debuginfo
libX11-xcb
libX11-common
libx11 (Debian package)
x11-libs/libX11
libX11-doc
libXpm
OpenShift API for Data Protection (OADP)
Migration Toolkit for Containers
IBM Cloud Pak for Multicloud Management
Red Hat OpenShift Container Platform
VMware Tanzu Operations Manager
RecoverPoint for VMs
Red Hat Single Sign-On
Dell EMC VxRail Appliance

How to mitigate CVE-2023-43787

Install updates from vendor's website.

libx11 - update to 1.8.7
Data Lakehouse - update to 1.1.0.0
Cloud Pak for Network Automation - update to 2.7.4
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
libxpm4 (Ubuntu package) - addressed in versions Ubuntu Pro, 1:3.5.12-1ubuntu0.20.04.2, 1:3.5.12-1ubuntu0.22.04.2, 1:3.5.12-1.1ubuntu0.1
libx11-6 (Ubuntu package) - addressed in versions Ubuntu Pro, 2:1.6.9-2ubuntu1.6, 2:1.7.5-1ubuntu0.3, 2:1.8.4-2ubuntu0.3
Migration Toolkit for Runtimes - update to 1.2.6
OpenShift API for Data Protection (OADP) - update to 1.3.2
libX11 - addressed in versions 1.6.0-2.2.16, 1.7.2-3
libX11-6-32bit - addressed in versions 1.6.2-12.33.1, 1.6.5-150000.3.33.1
libX11-xcb1-debuginfo-32bit - update to 1.6.2-12.33.1
libX11-xcb1-32bit - addressed in versions 1.6.2-12.33.1, 1.6.5-150000.3.33.1
libX11-6-debuginfo-32bit - update to 1.6.2-12.33.1
libX11-data - addressed in versions 1.6.2-12.33.1, 1.6.5-150000.3.33.1
libX11-xcb1 - addressed in versions 1.6.2-12.33.1, 1.6.5-150000.3.33.1
libX11-6 - addressed in versions 1.6.2-12.33.1, 1.6.5-150000.3.33.1
libX11-xcb1-debuginfo - addressed in versions 1.6.2-12.33.1, 1.6.5-150000.3.33.1
libX11-6-debuginfo - addressed in versions 1.6.2-12.33.1, 1.6.5-150000.3.33.1
libX11-devel - addressed in versions 1.6.2-12.33.1, 1.6.5-150000.3.33.1
libX11-debugsource - addressed in versions 1.6.2-12.33.1, 1.6.5-150000.3.33.1
libX11-xcb1-32bit-debuginfo - update to 1.6.5-150000.3.33.1
libX11-devel-32bit - update to 1.6.5-150000.3.33.1
libX11-6-32bit-debuginfo - update to 1.6.5-150000.3.33.1
libX11 (Red Hat package) - addressed in versions 1.6.8-8.el8, 1.7.0-9.el9
libX11-debugsource - update to 1.6.9-8
libX11-devel - update to 1.6.9-8
libX11-help - update to 1.6.9-8
libX11-debuginfo - update to 1.6.9-8
libX11 - update to 1.6.9-8
libX11 - addressed in versions 1.7.0-9, 1.8.7-1
libX11-devel - addressed in versions 1.7.0-9, 1.8.7-1
libX11-xcb - addressed in versions 1.7.0-9, 1.8.7-1
libX11-common - addressed in versions 1.7.0-9, 1.8.7-1
libx11 (Debian package) - addressed in versions 2:1.7.2-1+deb11u2, 2:1.8.4-2+deb12u2
Migration Toolkit for Containers - update to 1.8.4
x11-libs/libX11 - update to 1.8.7
libX11 - update to 1.8.7
libX11-doc - update to 1.8.7-1
IBM Cloud Pak for Multicloud Management - update to 2.3 FP11
VMware Tanzu Operations Manager - addressed in versions 2.7.25, 2.8.16, 2.9.12, 2.10.3, 2.10.39
Isolation Segment - addressed in versions 2.11.41, 2.11.42, 2.13.26, 2.13.27, 3.0.18, 3.0.19, 3.0.20, 4.0.10, 4.0.11, 4.0.12
VMware Tanzu Application Service for VMs - addressed in versions 2.11.47, 2.11.48, 2.13.29, 2.13.30, 3.0.18, 3.0.19, 3.0.20, 4.0.10, 4.0.11, 4.0.12
libXpm - addressed in versions 3.5.10-2.12, 3.5.15-2
Red Hat OpenShift Dev Spaces - update to 3.16.0
Platform Automation Toolkit - addressed in versions 4.0.13, 4.1.13, 4.2.8, 4.3.5
Enterprise SONiC - update to 4.2.1
IBM Cloud Pak for Watson AIOps - update to 4.6.0
Red Hat OpenShift Container Platform - addressed in versions 4.13.45, 4.14.32, 4.14.33, 4.16.15, 4.17.0
App Connect Enterprise Certified Container - addressed in versions 5.0.14, 11.2.0
RecoverPoint for VMs - update to 6.0.SP1.P1
Red Hat Migration Toolkit for Applications - addressed in versions 6.2.3, 7.0.3
Red Hat Single Sign-On - update to 7.6.9
Dell EMC VxRail Appliance - update to 8.0.120

External References

Related Security Bulletins