CVE-2023-43785

MediumCVSS 5.5/10Last modified Nov 7, 2026

Description

A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-787 CWE-125

Affected software

Vendor	Product	Versions
—	—	< 1.8.7
Red Hat	Red Hat Enterprise Linux 8	—
Red Hat	Red Hat Enterprise Linux 9	—
Red Hat	Red Hat Enterprise Linux 6	—
Red Hat	Red Hat Enterprise Linux 7	—

References

https://access.redhat.com/errata/RHSA-2024:2145
https://access.redhat.com/errata/RHSA-2024:2973
https://access.redhat.com/security/cve/CVE-2023-43785Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2242252Issue Tracking, Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:2145
https://access.redhat.com/errata/RHSA-2024:2973
https://access.redhat.com/security/cve/CVE-2023-43785Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2242252Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/10/msg00004.html
https://security.netapp.com/advisory/ntap-20231103-0006/

Timeline

Published: Oct 10, 2023
Last modified: Nov 7, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-437865.5A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all CVE-2023-437877.8A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger CVE-2023-437885.5A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local CVE-2023-437895.5A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read CVE-2023-43797.5An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to CVE-2023-437905.4iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the obj CVE-2023-437918.8Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained CVE-2023-437929.8baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of ba CVE-2023-437937.5Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authent CVE-2023-437944.9Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticat CVE-2023-437959.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Serv CVE-2023-437965.3Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queried