CVE-2023-45919 - Vulnerability Details - OpenCVE

Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable no

Technical Impact partial

Vendors	Products
Mesa3d	Mesa

Configuration 1 [-]

cpe:2.3:a:mesa3d:mesa:23.0.4:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2024/Jan/47
https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858

History

Thu, 29 May 2025 16:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Mesa3d Mesa3d mesa
CPEs		cpe:2.3:a:mesa3d:mesa:23.0.4:::::::*
Vendors & Products		Mesa3d Mesa3d mesa

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2024-03-27T00:00:00

Updated: 2024-08-02T20:29:32.501Z

Reserved: 2023-10-16T00:00:00

Link: CVE-2023-45919

Vulnrichment

Updated: 2024-07-10T14:23:39.335Z

NVD

Status : Analyzed

Published: 2024-03-27T05:15:47.030

Modified: 2025-05-29T15:30:57.727

Link: CVE-2023-45919

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-45919", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-02T20:29:32.501Z", "dateReserved": "2023-10-16T00:00:00", "datePublished": "2024-03-27T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-03-27T04:13:01.063014"}, "descriptions": [{"lang": "en", "value": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server."}], "tags": ["disputed"], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858"}, {"name": "20240126 Buffer Overflow in glXQueryServerString() of mesa", "tags": ["mailing-list"], "url": "http://seclists.org/fulldisclosure/2024/Jan/47"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-126", "lang": "en", "description": "CWE-126 Buffer Over-read"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-07-10T14:20:17.492374Z", "id": "CVE-2023-45919", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-10T14:28:38.504Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T20:29:32.501Z"}, "title": "CVE Program Container", "references": [{"url": "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858", "tags": ["x_transferred"]}, {"name": "20240126 Buffer Overflow in glXQueryServerString() of mesa", "tags": ["mailing-list", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2024/Jan/47"}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mesa3d:mesa:23.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "BB4E18DD-7D05-4817-9F53-B83668D37872", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [{"sourceIdentifier": "[email protected]", "tags": ["disputed"]}], "descriptions": [{"lang": "en", "value": "Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server."}, {"lang": "es", "value": "Se descubri\u00f3 que Mesa 23.0.4 conten\u00eda un b\u00fafer sobrele\u00eddo en glXQueryServerString(). NOTA: esto est\u00e1 en disputa porque no hay situaciones comunes en las que los usuarios requieran una operaci\u00f3n ininterrumpida con un servidor controlador de atacante."}], "id": "CVE-2023-45919", "lastModified": "2025-05-29T15:30:57.727", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-03-27T05:15:47.030", "references": [{"source": "[email protected]", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2024/Jan/47"}, {"source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"], "url": "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://seclists.org/fulldisclosure/2024/Jan/47"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-126"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}