CVE-2024-9632 — Heap-based Buffer Overflow in Xorg-server

CWE-122 — Heap-based Buffer Overflow10 documents9 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 82.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
X.org Xorg-serverX.org Xwayland
Timeline
PublishedOct 30

Description

A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions where the X.org server is run with root privileges.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶Debianx.org/xorg-server< 2:1.20.11-1+deb11u14+3
▶Debianx.org/xwayland< 2:24.1.4-1+1

🔴Vulnerability Details

3
CVEList
Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability↗2024-10-30
▶
GHSA
GHSA-cjcf-6ch6-g3rx: A flaw was found in the X↗2024-10-30
▶
OSV
CVE-2024-9632: A flaw was found in the X↗2024-10-30
▶

📋Vendor Advisories

6
Ubuntu
X.Org X Server vulnerability↗2024-10-30
▶
Ubuntu
X.Org X Server vulnerability↗2024-10-30
▶
BSD
OpenBSD 7.5 Errata 012: SECURITY FIX↗2024-10-29
▶
Red Hat
xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability↗2024-10-29
▶
Microsoft
Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability↗2024-10-08
▶
CVE-2024-9632 — Heap-based Buffer Overflow | cvebase