{"id":"CVE-2023-6377","summary":"Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions","details":"A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.","modified":"2026-05-19T02:08:38.051287Z","published":"2023-12-13T06:27:40.758Z","related":["ALSA-2024:0010","ALSA-2024:0018","ALSA-2024:2169","ALSA-2024:2170","ALSA-2024:2995","ALSA-2024:2996","SUSE-SU-2023:4787-1","SUSE-SU-2023:4788-1","SUSE-SU-2023:4789-1","SUSE-SU-2023:4790-1","SUSE-SU-2023:4791-1","SUSE-SU-2023:4792-1","SUSE-SU-2023:4925-1","SUSE-SU-2023:4926-1","SUSE-SU-2023:4933-1","SUSE-SU-2023:4934-1","SUSE-SU-2023:4935-1","SUSE-SU-2023:4949-1","openSUSE-SU-2024:13512-1","openSUSE-SU-2024:13513-1"],"database_specific":{"cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6377.json","cna_assigner":"redhat"},"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/12/13/1"},{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/12/msg00013.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R63Z6GIWM3YUNZRCGFODUXLW3GY2HD6/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PP47YXKM5ETLCYEF6473R3VFCJ6QT2S/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFHV5KCQ2SVOD4QMCPZ5HC6YL44L7YJD/"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/"},{"type":"WEB","url":"https://lists.x.org/archives/xorg-announce/2023-December/003435.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:7886"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0006"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0009"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0010"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0014"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0015"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0016"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0018"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:0020"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:2169"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:2170"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:2995"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2024:2996"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2025:13998"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2023-6377"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6377.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6377"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/202401-30"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240125-0003/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5576"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253291"},{"type":"FIX","url":"https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.freedesktop.org/xorg/xserver","events":[{"introduced":"0"},{"fixed":"0c1a93d319558fe3ab2d94f51d174b4f93810afd"}],"database_specific":{"source":"REFERENCES"}}],"versions":["xorg-server-21.0.99.1","xorg-server-1.20.0","xorg-server-1.19.99.905","xorg-server-1.19.99.904","xorg-server-1.19.99.903","xorg-server-1.19.99.902","xorg-server-1.19.99.901","xorg-server-1.19.0","xorg-server-1.18.99.902","xorg-server-1.18.99.901","xorg-server-1.18.99.2","xorg-server-1.18.0","xorg-server-1.17.99.902","xorg-server-1.17.99.901","xorg-server-1.17.0","xorg-server-1.16.99.902","xorg-server-1.16.99.901","xorg-server-1.16.0","xorg-server-1.15.99.904","xorg-server-1.15.99.903","xorg-server-1.15.99.902","xorg-server-1.15.99.901","xorg-server-1.15.0","xorg-server-1.14.99.905","xorg-server-1.14.99.904","xorg-server-1.14.99.903","xorg-server-1.14.99.902","xorg-server-1.14.99.901","xorg-server-1.14.99.3","xorg-server-1.14.99.2","xorg-server-1.14.99.1","xorg-server-1.14.0","xorg-server-1.13.99.902","xorg-server-1.13.99.901","xorg-server-1.13.0","xorg-server-1.12.99.905","xorg-server-1.12.99.904","xorg-server-1.12.99.903","xorg-server-1.12.99.902","xorg-server-1.12.99.901","xorg-server-1.12.0","xorg-server-1.11.99.903","xorg-server-1.11.99.902","xorg-server-1.11.99.901","xorg-server-1.11.99.1","xorg-server-1.11.0","xorg-server-1.10.99.902","xorg-server-1.10.99.901","xorg-server-1.10.0","xorg-server-1.9.99.903","xorg-server-1.9.99.902","xorg-server-1.9.99.901","xorg-server-1.9.0","xorg-server-1.8.99.906","xorg-server-1.8.99.905","xorg-server-1.8.99.904","xorg-server-1.8.99.903","xorg-server-1.8.99.902","xorg-server-1.8.99.901","xorg-server-1.8.0","xorg-server-1.7.99.902","xorg-server-1.7.99.901","xorg-server-1.7.99.2","xorg-server-1.7.99.1","xorg-server-1.6.99.901","xorg-server-1.6.99.900","xorg-server-1.5.99.1","xorg-server-1.1.99.3","xorg-server-1_1_99_2","xorg-server-1_0_99_901","XORG-7_0_99_901","xorg-server-1_1_99_1","xorg-server-1_0_99_2","xorg-server-1_0_99_1","XORG-7_0","pre-xgldrop-merge","XORG-6_99_99_904","MODULAR_COPY","XORG-6_99_99_903","XORG-6_8_99_903","DRM-2_0_0","XORG-6_99_99_902","XORG-6_8_99_902","DRM-1_0_5","XORG-6_99_99_901","XORG-6_8_99_901","DRM-20051017","kdrive-initial-import","xorg-server-0_99_1","XORG-6_99_99_900","XORG-6_8_99_900","XORG-6_8_99_16","XORG-6_8_99_15","XORG-6_8_99_14","XORG-6_8_99_13","XORG-6_8_99_12","DRM-20050615","sco_port_update-base","XORG-6_8_99_11","XORG-6_8_99_10","XORG-6_8_99_9","XORG-6_8_99_8","XORG-6_8_99_7","XORG-6_8_99_6","XORG-6_8_99_5","XORG-6_8_99_4","XORG-6_8_99_3","XORG-6_8_99_2","XORG-6_8_99_1","lg3d-base","XORG-6_8_0","XORG-6_7_99_904","XORG-6_7_99_903","XORG-6_7_99_902","XORG-6_7_99_901","XORG-6_7_99_2","XORG-6_7_99_1","DRM-20040721","DRI-trunk-20040721","DRI-trunk-20040613","DRI-XFree86-4_3_99_12-merge","DRM-20040613","XACE-SELINUX-MERGE","xf86-4_4_99_1","xf86-4_4_0","xf86-4_3_99_903","xf86-4_3_99_903_special","add-Xi","xf86-012804-2330","xf86-4_3_99_902","xf86-4_3_99_901","dri-0-1-branchpoint","xf86-4_3_99_16","xf86-4_3_0_1","PRE_xf86-4_3_0_1","XORG-MAIN","xfixes_2_branchpoint","keithp","xf-4_3_99_6","xf-4_3_99_5","xf-4_3_99_4","xf-4_3_99_3","xf-4_3_99_2","xf-4_3_99_1","xf-4_3_0_1","xf-4_3_0","xf-4_2_99_902","xf-4_2_99_901","xf-4_2_99_4","xf-4_2_99_3","ah-20021030-postdri","xf-4_2_99_2","ah-20021030","dhd-20020916","xf-4_2_99_1","dri-20020222-merge","before-mesa-4_0-import","dri-20020129-merge","xf-4_2_1_1","xf-4_2_1","xf-4_2_0_1","xf-4_2_0-bindist-1","xf-4_2_0-bindist","xf-4_2_0","xf-4_2-bp","xf-4_1_99_7","xf-4_1_99_6","xf-4_1_99_5","xf-4_1_99_4","Domain-sync4","Domain-sync3","xf-4_1_99_3","xf-4_1_99_2","Domain-sync2","Domain-sync1","Domain-base","xf-4_1_99_1","dhd-20010817","xf-4_0_99_900","xf-4_0_99_3","xf-4_0_99_2","dhd-20010328","xf-4_0_99_1","xf-4_0_2-bindist","xf-4_0_2","xf-4_0_1Zc","xf-4_0_1Zb","pre-R651-import","xf-4_0_1Za","xf-4_0_1Z","xf-4_0_1h","xf-4_0_1g","xf-4_0_1f","xf-4_0_1e","xf-4_0_1d","xf-4_0_1c","xf-4_0_1b","xf-4_0g","xf-4_0f","xf-4_0e","xf-4_0d","xf-4_0c","xf-4_0_1a","xf-4_0_1-bindist","xf-4_0_1","xf-4_0Z","xf-4_0b","xf-4_0a","xf-4_0-bindist","xf-4_0","xf-3_9_18b","xf-3_9_18a","xf-3_9_18Za","xf-3_9_18Z","xf-3_9_18","xf-3_9_17f","xf-3_9_17e","xf-3_9_17d","xf-3_9_17c","xf-3_9_17b","xf-3_9_17a","xf-3_9_17Z","xf-3_9_17","xf-3_9_16Za","xf-3_9_16f","xf-3_9_16e","xf-3_9_16d","xf-3_9_16Z"],"database_specific":{"vanir_signatures":[{"target":{"file":"dix/devices.c"},"deprecated":false,"source":"https://gitlab.freedesktop.org/xorg/xserver@0c1a93d319558fe3ab2d94f51d174b4f93810afd","digest":{"line_hashes":["252687557648165217032608315038685411166","279832323036604406034105090042523305377","174046644956456337769873931283469710560","270428353536077042820062109791272058548","5306838274834198535579455753337315613","195921679156969440801451686002829746101","151396372718625826199537758261571665405","100013151932802024797321693179340322742"],"threshold":0.9},"id":"CVE-2023-6377-463adbeb","signature_version":"v1","signature_type":"Line"},{"target":{"file":"Xi/exevents.c"},"deprecated":false,"source":"https://gitlab.freedesktop.org/xorg/xserver@0c1a93d319558fe3ab2d94f51d174b4f93810afd","digest":{"line_hashes":["62568919244241268195688987013639948482","37362957716343082407980267540572748816","16654370904255052517393063963994389453","98929824099361305544272899779512004429","241158125650748516153140667877312646975","59866509609299917617511806777220449800","284319984216367116843112254247973226776","258475138249273764119512146929409733069","44026588089028579398453030731936440344","144310107527399638380947153528855736910"],"threshold":0.9},"id":"CVE-2023-6377-bb1b42ed","signature_version":"v1","signature_type":"Line"},{"target":{"file":"Xi/exevents.c","function":"DeepCopyPointerClasses"},"deprecated":false,"source":"https://gitlab.freedesktop.org/xorg/xserver@0c1a93d319558fe3ab2d94f51d174b4f93810afd","digest":{"function_hash":"147771937936268740377913836205570780749","length":4368},"id":"CVE-2023-6377-c23d4ecb","signature_version":"v1","signature_type":"Function"},{"target":{"file":"dix/devices.c","function":"RecalculateMasterButtons"},"deprecated":false,"source":"https://gitlab.freedesktop.org/xorg/xserver@0c1a93d319558fe3ab2d94f51d174b4f93810afd","digest":{"function_hash":"253571254798004793955492070510461122682","length":1557},"id":"CVE-2023-6377-e7c9187f","signature_version":"v1","signature_type":"Function"}],"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-6377.json","vanir_signatures_modified":"2026-05-19T02:08:38Z"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}