1. Home
  2. CVE Database
  3. CVE-2024-0409
HIGH · 7.8

CVE-2024-0409

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiati...

Vulnerability Description

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.

CVSS Score

7.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
TigervncTigervnc< 1.13.1
X.OrgX Server< 21.1.11
X.OrgXwayland< 23.2.4
FedoraprojectFedora39
RedhatEnterprise Linux6.0
RedhatEnterprise Linux Desktop7.0
RedhatEnterprise Linux For Ibm Z Systems7.0
RedhatEnterprise Linux For Power Big Endian7.0
RedhatEnterprise Linux For Power Little Endian7.0
RedhatEnterprise Linux For Scientific Computing7.0
RedhatEnterprise Linux Server7.0
RedhatEnterprise Linux Workstation7.0

Related Weaknesses (CWE)

CWE-787

References

FAQ

What is CVE-2024-0409?

CVE-2024-0409 is a vulnerability with a CVSS score of 7.8 (HIGH). A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiati...

How severe is CVE-2024-0409?

CVE-2024-0409 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-0409?

Check the references section above for vendor advisories and patch information. Affected products include: Tigervnc Tigervnc, X.Org X Server, X.Org Xwayland, Fedoraproject Fedora, Redhat Enterprise Linux.