{"action":"Upgrade xorg-server to 21.1.11-r0 or later.","affected":[{"fixed":"21.1.11-r0","introduced":"0"}],"component":"xorg-server","cve_ids":[],"ecosystem":"Alpine","ecosystem_qualifier":"Alpine:v3.23","exploited":false,"fixed_versions":["21.1.11-r0"],"id":"tcs_01M6GXV147YMF4QQ0WWCSKCE7X","modified_at":"2026-11-03T06:32:44.432281995Z","published_at":"2024-01-18T16:15:08.380Z","references":["https://osv.dev/vulnerability/ALPINE-CVE-2024-0408","https://security.alpinelinux.org/vuln/CVE-2024-0408"],"severity":{"label":"medium","score":5.5},"sources":[{"source":"osv","source_id":"ALPINE-CVE-2024-0408#Alpine:v3.23/xorg-server","url":"https://osv.dev/vulnerability/ALPINE-CVE-2024-0408"}],"summary":"A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (a"}