{
  "threat_severity" : "Important",
  "public_date" : "2024-01-16T00:00:00Z",
  "bugzilla" : {
    "description" : "xorg-x11-server: SELinux context corruption",
    "id" : "2257690",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2257690"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-787",
  "details" : [ "A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.", "A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context." ],
  "statement" : "Xorg server does not run with root privileges in Red Hat Enterprise Linux 8 and 9; therefore, Red Hat Enterprise Linux 8 and 9 have been rated with Moderate severity.",
  "acknowledgement" : "Red Hat would like to thank Olivier Fourdan for reporting this issue.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2024-01-22T00:00:00Z",
    "advisory" : "RHSA-2024:0320",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "xorg-x11-server-0:1.20.4-27.el7_9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-05-22T00:00:00Z",
    "advisory" : "RHSA-2024:2995",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "xorg-x11-server-0:1.20.11-22.el8",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2024-05-22T00:00:00Z",
    "advisory" : "RHSA-2024:2996",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "xorg-x11-server-Xwayland-0:21.1.3-15.el8",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-04-30T00:00:00Z",
    "advisory" : "RHSA-2024:2169",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "xorg-x11-server-0:1.20.11-24.el9",
    "impact" : "moderate"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2024-04-30T00:00:00Z",
    "advisory" : "RHSA-2024:2170",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "xorg-x11-server-Xwayland-0:22.1.9-5.el9",
    "impact" : "moderate"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "tigervnc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "xorg-x11-server",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "tigervnc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "tigervnc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "tigervnc",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2024-0409\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-0409" ],
  "name" : "CVE-2024-0409",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}