CVE-2024-0409

Description

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.

References

https://security.netapp.com/advisory/ntap-20240307-0006/

https://security.gentoo.org/glsa/202401-30

https://lists.fedoraproject.org/archives/list/[email protected]/message/IZ75X54CN4IFYMIV7OK3JVZ57FHQIGIC/

https://lists.fedoraproject.org/archives/list/[email protected]/message/EJBMCWQ54R6ZL3MYU2D2JBW6JMZL7BQW/

https://lists.fedoraproject.org/archives/list/[email protected]/message/5J4H7CH565ALSZZYKOJFYDA5KFLG6NUK/

https://lists.debian.org/debian-lts-announce/2024/01/msg00016.html

https://bugzilla.redhat.com/show_bug.cgi?id=2257690

https://access.redhat.com/security/cve/CVE-2024-0409

https://access.redhat.com/errata/RHSA-2024:2170

https://access.redhat.com/errata/RHSA-2024:2169

https://access.redhat.com/errata/RHSA-2024:0320

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3