Summary
The libX11 packages contain the core X11 protocol client library.
Security Fix(es):
* libX11: out-of-bounds memory access in _XkbReadKeySyms() (CVE-2023-43785)
* libX11: stack exhaustion from infinite recursion in PutSubImage() (CVE-2023-43786)
* libX11: integer overflow in XCreateImage() leading to a heap overflow (CVE-2023-43787)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | libX11 | 1.7.0-9.el9 |
| AlmaLinux · 9 | libX11-common | 1.7.0-9.el9 |
| AlmaLinux · 9 | libX11-devel | 1.7.0-9.el9 |
| AlmaLinux · 9 | libX11-xcb | 1.7.0-9.el9 |
Vulnerabilities 3
-
High 7.8
Libx11: integer overflow in xcreateimage() leading to a heap overflow
A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.
-
Medium 6.5
Libx11: out-of-bounds memory access in _xkbreadkeysyms()
A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system.
-
Medium 5.5CVE-2023-43786 Public exploit
Libx11: stack exhaustion from infinite recursion in putsubimage()
A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.
References
-
report
https://access.redhat.com/security/cve/CVE-2023-43785
-
report
https://access.redhat.com/security/cve/CVE-2023-43786
-
report
https://access.redhat.com/security/cve/CVE-2023-43787
-
report
https://bugzilla.redhat.com/2242252
-
report
https://bugzilla.redhat.com/2242253
-
report
https://bugzilla.redhat.com/2242254
-
advisory
https://errata.almalinux.org/9/ALSA-2024-2145.html