Nixpkgs security tracker

Untriaged

Permalink CVE-2023-43787

7.8 HIGH

CVSS version: 3.1
Attack vector (AV): LOCAL
Attack complexity (AC): LOW
Privileges required (PR): NONE
User interaction (UI): REQUIRED
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): HIGH

created 4 months, 2 weeks ago

Libx11: integer overflow in xcreateimage() leading to a heap overflow

A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.

References

RHSA-2024:2145 vendor-advisoryx_transferredx_refsource_REDHAT
RHSA-2024:2973 vendor-advisoryx_transferredx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2023-43787 x_transferredvdb-entryx_refsource_REDHAT
RHBZ#2242254 x_transferredissue-trackingx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2024/01/24/9 x_transferred
https://jfrog.com/blog/xorg-libx11-vulns-cve-2023-43786-cve-2023-43787-part-two/ x_transferred
https://security.netapp.com/advisory/ntap-20231103-0006/ x_transferred
https://lists.debian.org/debian-lts-announce/2023/10/msg00005.html

Affected products

libX11

*
<1.8.7
==1.8.7

Matching in nixpkgs

pkgs.xorg.libX11

None

nixos-unstable 1.8.12
- nixpkgs-unstable 1.8.12
- nixos-unstable-small 1.8.12

pkgs.tests.pkg-config.defaultPkgConfigPackages.x11

Test whether libX11-1.8.12 exposes pkg-config modules x11

nixos-unstable libX11
- nixpkgs-unstable libX11
- nixos-unstable-small libX11

Suggestion detail

References

Affected products

Matching in nixpkgs

pkgs.xorg.libX11

pkgs.tests.pkg-config.defaultPkgConfigPackages.x11