CVE-2023-6377

HighCVSS 7.8/10Last modified Nov 4, 2026

Description

A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
Red HatRed Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—
Red HatRed Hat Enterprise Linux 8.2 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.2 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—
Red HatRed Hat Enterprise Linux 8.4 Telecommunications Update Service—
Red HatRed Hat Enterprise Linux 8.4 Update Services for SAP Solutions—
Red HatRed Hat Enterprise Linux 8.6 Extended Update Support—
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.0 Extended Update Support—
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—
Red HatRed Hat Enterprise Linux 6—

References

Timeline

Published
Dec 13, 2023
Last modified
Nov 4, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-63787.5A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service CVE-2023-63796.1Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerabCVE-2023-63806.1Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker couldCVE-2023-63815.5Improper input validation vulnerability in Newsletter Software SuperMailer affecting version 11.20.0.2204. An attacker could exploit this vuCVE-2023-63825.4The Master Slider – Responsive Touch Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ms_slide' shCVE-2023-63837.5The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download CVE-2023-63844.3The WP User Profile Avatar WordPress plugin before 1.0.1 does not properly check for authorisation, allowing authors to delete and update arCVE-2023-63854.3The WordPress Ping Optimizer WordPress plugin through 2.35.1.3.0 does not have CSRF checks in some places, which could allow attackers to maCVE-2023-63867.5A denial of service vulnerability was identified in GitLab CE/EE, affecting all versions from 15.11 prior to 16.6.7, 16.7 prior to 16.7.5 anCVE-2023-63877.5A potential buffer overflow exists in the Bluetooth LE HCI CPC sample application in the Gecko SDK which may result in a denial of service oCVE-2023-63885.0Suite CRM version 7.14.2 allows making arbitrary HTTP requests through the vulnerable server. This is possible because the application is vCVE-2023-63896.1The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthentic