Red Hat Security Advisory: libX11 security update

Fixed packages 7

Vulnerabilities 3

• High 7.8
  CVE-2023-43787

  Libx11: integer overflow in xcreateimage() leading to a heap overflow

  A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Oct 10, 2023
• Medium 6.5
  CVE-2023-43785

  Libx11: out-of-bounds memory access in _xkbreadkeysyms()

  A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Oct 10, 2023
• Medium 5.5
  CVE-2023-43786 Public exploit

  Libx11: stack exhaustion from infinite recursion in putsubimage()

  A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  Oct 10, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242252
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242253
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2242254
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2145.json
• report
  https://access.redhat.com/security/cve/CVE-2023-43785
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-43785
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-43785
• report
  https://access.redhat.com/security/cve/CVE-2023-43786
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-43786
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-43786
• report
  https://access.redhat.com/security/cve/CVE-2023-43787
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-43787
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-43787