CVE-2024-21886

NameCVE-2024-21886
DescriptionA heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3721-1, DSA-5603-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xorg-server (PTS)bullseye2:1.20.11-1+deb11u13fixed
bullseye (security)2:1.20.11-1+deb11u14fixed
bookworm, bookworm (security)2:21.1.7-3+deb12u8fixed
sid, trixie2:21.1.14-2fixed
xwayland (PTS)bookworm2:22.1.9-1vulnerable
sid, trixie2:24.1.4-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xorg-serversourcebuster2:1.20.4-1+deb10u13DLA-3721-1
xorg-serversourcebullseye2:1.20.11-1+deb11u11DSA-5603-1
xorg-serversourcebookworm2:21.1.7-3+deb12u5DSA-5603-1
xorg-serversource(unstable)2:21.1.11-1
xwaylandsource(unstable)2:23.2.4-1

Notes

[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
https://lists.x.org/archives/xorg/2024-January/061525.html
https://gitlab.freedesktop.org/xorg/xserver/-/commit/bc1fdbe46559dd947674375946bbef54dd0ce36b
https://gitlab.freedesktop.org/xorg/xserver/-/commit/26769aa71fcbe0a8403b7fb13b7c9010cc07c3a8
Regression: https://gitlab.freedesktop.org/xorg/xserver/-/issues/1623

Search for package or bug name: Reporting problems