attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
see table below
Classified as
CWE-121 (Stack-based Buffer Overflow)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Enterprise Linux
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Red Hat
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Red Hat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION
x.org
x_server
x.org
xwayland
Subsystems
OT Supporting Infrastructure
Sectors
All Sectors
What to Know
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root. (NVD)
What to Do
Monitor Red Hat's and x.org's web pages for any future patch releases. See vendor advisory link below.