CVE-2024-9632

Public on 2024-10-30
Modified on 2024-11-12
Description
A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions where the X.org server is run with root privileges.
Severity
Important severity
Important
CVSS v3 Base Score
7.8
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
Amazon Linux 1 tigervnc No Fix Planned
Amazon Linux 2 - Core tigervnc Pending Fix
Amazon Linux 2023 wayland Not Affected
Amazon Linux 1 xorg-x11-server No Fix Planned
Amazon Linux 2 - Core xorg-x11-server Pending Fix
Amazon Linux 2023 xorg-x11-server 2024-11-13 ALAS2023-2024-756 Fixed

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv3 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD CVSSv3 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H