MEDIUM✓ PATCH🇵🇱 Wersja polska

CVE-2024-0408

CVSS 5.5v3.1pub. 2024-01-18upd. 2025-08-29

A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

  • Fedora Project Fedora

    OS
    Fedoraproject
    39

  • Red Hat Enterprise Linux

    OS
    Redhat
    6.07.08.09.0

  • Red Hat Enterprise Linux Desktop

    OS
    Redhat
    7.0

  • Red Hat Enterprise Linux For IBM Z Systems

    OS
    Redhat
    7.0

  • Red Hat Enterprise Linux For Power Big Endian

    OS
    Redhat
    7.0

  • Red Hat Enterprise Linux For Power Little Endian

    OS
    Redhat
    7.0

  • Red Hat Enterprise Linux For Scientific Computing

    OS
    Redhat
    7.0

  • Red Hat Enterprise Linux Server

    OS
    Redhat
    7.0

  • Red Hat Enterprise Linux Workstation

    OS
    Redhat
    7.0

  • Tigervnc

    APP
    Tigervnc
    < 1.13.1

  • X.org X Server

    APP
    X.Org
    < 21.1.11

  • X.org Xwayland

    APP
    X.Org
    < 23.2.4
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2025-32463CRITICAL9.3⚠ KEVPL ✓ten sam produkt

Sudo: eskalacja uprawnień do root poprzez opcję --chroot (CVE-2025-32463)

CVE-2024-4577CRITICAL9.8⚠ KEVPL ✓ten sam produkt

PHP CGI argument injection – RCE na Windows przez mechanizm Best-Fit

CVE-2024-5274CRITICAL9.6⚠ KEVPL ✓ten sam produkt

Type Confusion w V8 (Google Chrome) — RCE przez spreparowaną stronę HTML

CVE-2024-4947CRITICAL9.6⚠ KEVPL ✓ten sam produkt

Type Confusion w silniku V8 Chrome — zdalne wykonanie kodu (RCE)

CVE-2024-4671CRITICAL9.6⚠ KEVPL ✓ten sam produkt

Use-after-free w Google Chrome Visuals umożliwiający ucieczkę z sandbox