| Package | libx11 |
|---|---|
| Version | 2:1.6.2-3+deb8u7 (jessie), 2:1.6.4-3+deb9u6 (stretch) |
| Related CVEs | CVE-2023-43785 CVE-2023-43786 CVE-2023-43787 |
Several vulnerabilities were found in libx11, the X11 client-side library.
CVE-2023-43785
Gregory James Duck discovered an out of bounds memory access in
_XkbReadKeySyms, which could result in denial of service.
CVE-2023-43786
Yair Mizrahi found an infinite recursion in PutSubImage when
parsing a crafted file, which would result in stack exhaustion
and denial of service.
CVE-2023-43787
Yair Mizrahi discovered an integer overflow in XCreateImage
when parsing crafted input, which would result in a small buffer
allocation leading into a buffer overflow. This could result
in denial of service or potentially in arbitrary code execution.
For Debian 8 jessie, these problems have been fixed in version 2:1.6.2-3+deb8u7.
For Debian 9 stretch, these problems have been fixed in version 2:1.6.4-3+deb9u6.
We recommend that you upgrade your libx11 packages.
Further information about Extended LTS security advisories can be found in the dedicated section of our website.