Skip to content
Fencer Vulns
high 7.5

CVE-2023-3138 json

A vulnerability was found in libX11.

published 2023-06-28 3 y ago modified 2026-07-25 3 mo ago also EUVD-2023-43823 , JLSEC-2026-472

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.7%
EPSS 1.7% chance of exploitation in 30 days, percentile 76%
public exploits
0
none known

Summary

A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.

Patch / fix

  • julia Xorg_libX11_jll 1.8.6+0
  • x.org libx11 1.8.6
  • libx11 Debian 12 2:1.8.4-2+deb12u1
  • libx11 Debian 14, Debian 13 2:1.8.6-1

debian advisories DEBIAN-CVE-2023-3138

  • libx11 Ubuntu 20.04 LTS 2:1.6.9-2ubuntu1.5
  • libx11 Ubuntu 22.04 LTS 2:1.7.5-1ubuntu0.2
  • libx11 Ubuntu Pro 14.04 LTS 2:1.6.2-1ubuntu2.1+esm3
  • libx11 Ubuntu Pro 16.04 LTS 2:1.6.3-1ubuntu2.2+esm2
  • libx11 Ubuntu Pro 18.04 LTS 2:1.6.4-3ubuntu0.4+esm1

ubuntu advisories UBUNTU-CVE-2023-3138

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libX11 RHEL 8 1.6.8-6.el8
  • libX11-xcb RHEL 8 1.6.8-6.el8
  • libX11-common RHEL 8 1.6.8-6.el8
  • libX11 RHEL 9 1.7.0-8.el9
  • libX11-xcb RHEL 9 1.7.0-8.el9
  • libX11-common RHEL 9 1.7.0-8.el9
  • libX11 RHEL 8.8 EUS 1.6.8-6.el8_8
  • libX11-xcb RHEL 8.8 EUS 1.6.8-6.el8_8

red hat advisories RHSA-2024:1417RHSA-2024:1088RHSA-2023:7029RHSA-2023:6497

  • libX11 SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +20 more 1.6.5-150000.3.30.1
  • libX11 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +6 more 1.6.2-12.30.1

suse advisories SUSE-SU-2023:2614-1SUSE-SU-2023:2531-1

  • libX11 AlmaLinux 8 1.6.8-6.el8
  • libX11-xcb AlmaLinux 8 1.6.8-6.el8
  • libX11-common AlmaLinux 8 1.6.8-6.el8
  • libX11 AlmaLinux 9 1.7.0-8.el9
  • libX11-xcb AlmaLinux 9 1.7.0-8.el9
  • libX11-common AlmaLinux 9 1.7.0-8.el9

almalinux advisories ALSA-2023:7029ALSA-2023:6497

  • libx11 Alpine 3.15 1.7.3.1-r1
  • libx11 Alpine 3.16 1.8-r1
  • libx11 Alpine 3.17 1.8.4-r1
  • libx11 Alpine 3.18 1.8.4-r4

alpine advisories ALPINE-CVE-2023-3138

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libX11 CBL-Mariner 2.0 1.6.12-6

azure linux advisories AZL-27274

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-3138 updated cvss 7.3

libX11: InitExt.c can overwrite unintended portions of the Display structure if the extension request leads to a buffer overflow

  • Red Hat Enterprise Linux 6 libX11, libX11-common Red Hat Enterprise Linux 7 libX11, libX11-common
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) libX11 1.6.8-6.el8, libX11-xcb 1.6.8-6.el8, libX11-common 1.6.8-6.el8
    fixed: vendor fix RHSA-2023:7029
  • Red Hat Enterprise Linux AppStream (v. 9) libX11 1.7.0-8.el9, libX11-xcb 1.7.0-8.el9, libX11-common 1.7.0-8.el9
    fixed: vendor fix RHSA-2023:6497
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) libX11 1.6.8-6.el8_8, libX11-xcb 1.6.8-6.el8_8, libX11-common 1.6.8-6.el8_8
    fixed: vendor fix RHSA-2024:1417
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) libX11 1.7.0-8.el9_2, libX11-xcb 1.7.0-8.el9_2, libX11-common 1.7.0-8.el9_2
    fixed: vendor fix RHSA-2024:1088

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.66% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
julia Xorg_libX11_jll
<1.8.6+0
1.8.6+0

Affected products

  • n/a libX11

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-787 Out-of-bounds Write

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.