Riskcovery

CVE-2024-9632

Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability

State
Published
Severity
7.8 High
Published
Oct 30, 2024
Updated
Mar 18, 2026
Reserved
Oct 8, 2024

Read the record on cve.org

Description

A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions where the X.org server is run with root privileges.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat

Weaknesses

Affected Products

ProductVersions
xorg-server
  • 1.1.1 to before 21.1.14Affected
Red Hat Enterprise Linux 10Red Hat
  • 0:24.1.5-3.el10_0 and laterNot affected
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONRed Hat
  • 0:1.1.0-25.el6_10.13 and laterNot affected
Red Hat Enterprise Linux 7 Extended Lifecycle SupportRed Hat
  • 0:1.8.0-34.el7_9 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:1.20.11-25.el8_10 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:21.1.3-17.el8_10 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:1.13.1-14.el8_10 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat
  • 0:1.9.0-15.el8_2.12 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat
  • 0:1.11.0-8.el8_4.11 and laterNot affected
Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceRed Hat
  • 0:1.11.0-8.el8_4.11 and laterNot affected
Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsRed Hat
  • 0:1.11.0-8.el8_4.11 and laterNot affected
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update SupportRed Hat
  • 0:1.12.0-6.el8_6.12 and laterNot affected
Red Hat Enterprise Linux 8.6 Telecommunications Update ServiceRed Hat
  • 0:1.12.0-6.el8_6.12 and laterNot affected
Red Hat Enterprise Linux 8.6 Update Services for SAP SolutionsRed Hat
  • 0:1.12.0-6.el8_6.12 and laterNot affected
Red Hat Enterprise Linux 8.8 Extended Update SupportRed Hat
  • 0:1.12.0-15.el8_8.11 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:1.14.1-1.el9_5 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:1.20.11-28.el9_6 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:23.2.7-3.el9_6 and laterNot affected
Red Hat Enterprise Linux 9.0 Update Services for SAP SolutionsRed Hat
  • 0:1.11.0-22.el9_0.12 and laterNot affected
Red Hat Enterprise Linux 9.2 Extended Update SupportRed Hat
  • 0:1.12.0-14.el9_2.9 and laterNot affected
Red Hat Enterprise Linux 9.4 Extended Update SupportRed Hat
  • 0:1.13.1-8.el9_4.4 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
    Red Hat Enterprise Linux 7Red Hat

      References

      Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.