| Name | CVE-2023-6816 |
| Description | A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-3721-1, DSA-5603-1 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| xorg-server (PTS) | bullseye | 2:1.20.11-1+deb11u13 | fixed |
| bullseye (security) | 2:1.20.11-1+deb11u14 | fixed | |
| bookworm, bookworm (security) | 2:21.1.7-3+deb12u8 | fixed | |
| trixie | 2:21.1.14-2 | fixed | |
| sid | 2:21.1.15-2 | fixed | |
| xwayland (PTS) | bookworm | 2:22.1.9-1 | vulnerable |
| sid, trixie | 2:24.1.4-2 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| xorg-server | source | buster | 2:1.20.4-1+deb10u13 | DLA-3721-1 | ||
| xorg-server | source | bullseye | 2:1.20.11-1+deb11u11 | DSA-5603-1 | ||
| xorg-server | source | bookworm | 2:21.1.7-3+deb12u5 | DSA-5603-1 | ||
| xorg-server | source | (unstable) | 2:21.1.11-1 | |||
| xwayland | source | (unstable) | 2:23.2.4-1 |
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
https://lists.x.org/archives/xorg/2024-January/061525.html
https://gitlab.freedesktop.org/xorg/xserver/-/commit/9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3