--- id: CVE-2023-6478 title: A flaw was found in xorg-server summary: >- A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information. severity: high cvss: 7.6 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L' cwe: - CWE-190 - CWE-190 vendor: x.org product: x_server affected: - x_server < 21.1.10 - xwayland < 23.2.3 - enterprise_linux_eus = 9.2 - debian_linux = 10.0 - debian_linux = 11.0 - debian_linux = 12.0 - tigervnc patched: - x_server 21.1.10 - xwayland 23.2.3 published: '2023-12-13' updated: '2026-06-23' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-6478' references: - url: 'https://access.redhat.com/errata/RHSA-2023:7886' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0006' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0009' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0010' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0014' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0015' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0016' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0017' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0018' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:0020' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:2169' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:2170' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:2995' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2024:2996' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2025:12751' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2023-6478' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2253298' label: secalert@redhat.com - url: >- https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632 label: secalert@redhat.com - url: 'https://lists.x.org/archives/xorg-announce/2023-December/003435.html' label: secalert@redhat.com - url: 'http://www.openwall.com/lists/oss-security/2023/12/13/1' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7886' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0006' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0009' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0010' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0014' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0015' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0016' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0017' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0018' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:0020' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:2169' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:2170' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:2995' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2024:2996' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/security/cve/CVE-2023-6478' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2253298' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://gitlab.freedesktop.org/xorg/xserver/-/commit/14f480010a93ff962fef66a16412fafff81ad632 label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2023/12/msg00008.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R63Z6GIWM3YUNZRCGFODUXLW3GY2HD6/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7PP47YXKM5ETLCYEF6473R3VFCJ6QT2S/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFHV5KCQ2SVOD4QMCPZ5HC6YL44L7YJD/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LJDFWDB7EQVZA45XDP7L5WRSRWS6RVRR/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.x.org/archives/xorg-announce/2023-December/003435.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202401-30' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20240125-0003/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2023/dsa-5576' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.01617 epssPercentile: 0.75001 ingestedAt: '2026-06-29T13:24:33.949Z' --- ## Overview A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information. ## Affected - `x_server < 21.1.10` - `xwayland < 23.2.3` - `enterprise_linux_eus = 9.2` - `debian_linux = 10.0` - `debian_linux = 11.0` - `debian_linux = 12.0` - `tigervnc` ## Remediation Upgrade past the affected range: - `x_server 21.1.10` - `xwayland 23.2.3`