Bug 1222041 (CVE-2023-45919)

Summary: VUL-0: CVE-2023-45919: Mesa: buffer over-read in glXQueryServerString()
Product: [Novell Products] SUSE Security Incidents Reporter: SMASH SMASH <smash_bz>
Component: IncidentsAssignee: Stefan Dirsch <sndirsch>
Status: IN_PROGRESS --- QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: carlos.lopez, gfx-bugs, gfx-enterprise-bugs
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/399110/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-45919:4.8:(AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:H)
Found By: Security Response Team Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description SMASH SMASH 2024-03-27 10:05:07 UTC 
Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-45919
http://seclists.org/fulldisclosure/2024/Jan/47
https://gitlab.freedesktop.org/mesa/mesa/-/issues/9858
https://www.cve.org/CVERecord?id=CVE-2023-45919
Comment 1 Stefan Dirsch 2024-03-27 10:14:27 UTC 
Ok. Thanks. Not sure what to do with this now. I would like to at least watch the issue on gitlab fdo, but seems this is not supported. I could try to poll this from time to time. But no promises given.