{"id":"CVE-2023-5574","aliases":["ALPINE-CVE-2023-5574","ALSA-2024:2298","AZL-31703","AZL-45255","BELL-CVE-2023-5574","DEBIAN-CVE-2023-5574","EUVD-2023-57870","GHSA-79x6-r5x5-fvqw","MGASA-2023-0307","OESA-2024-2261","OESA-2024-2314","OESA-2024-2315","OESA-2024-2316","OESA-2024-2317","RHSA-2024:2298","ROOT-OS-DEBIAN-11-CVE-2023-5574","ROOT-OS-DEBIAN-12-CVE-2023-5574","SUSE-SU-2023:4269-1","SUSE-SU-2023:4272-1","SUSE-SU-2023:4292-1","SUSE-SU-2023:4293-1","SUSE-SU-2023:4306-1","SUSE-SU-2023:4338-1","UBUNTU-CVE-2023-5574","openSUSE-SU-2024:13361-1","openSUSE-SU-2024:13467-1"],"status":"published","title":"Xorg-x11-server: use-after-free bug in damagedestroy","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00608,"percentile":0.49366,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2023-10-25T00:00:00Z","modified":"2026-11-05T09:47:25Z","fixes":[{"ecosystem":"Alpine:v3.18","package":"xorg-server","fixed_in":["21.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"xorg-server","fixed_in":["21.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"xorg-server","fixed_in":["21.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"xorg-server","fixed_in":["21.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"xorg-server","fixed_in":["21.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"xorg-server","fixed_in":["21.1.9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"xorg-server","fixed_in":["21.1.9-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"xorg-x11-server","fixed_in":["1.20.10-10"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"xorg-server","fixed_in":["21.1.12-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"xorg-server","fixed_in":["21.1.9-r0"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"xorg-x11-server","fixed_in":["1.20.11-32.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"xorg-x11-server","fixed_in":["1.20.11-33.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"xorg-x11-server","fixed_in":["1.20.11-33.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"xorg-x11-server","fixed_in":["1.20.11-33.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"xorg-x11-server","fixed_in":["1.20.8-30.oe2003sp4"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"xorg-server","fixed_in":["2:1.20.11-1+deb11u18.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-xorg-server","fixed_in":["2:1.20.11-1+deb11u18.aikido.13"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"xorg-server","fixed_in":["2:21.1.7-3+deb12u13.aikido.9"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-xorg-server","fixed_in":["2:21.1.7-3+deb12u13.aikido.9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xwayland","fixed_in":["23.2.2-2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.18","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.9-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tigervnc-icons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tigervnc-license","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tigervnc-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tigervnc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tigervnc-server-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tigervnc-server-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Azure Linux:2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.10-10"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.20.10-6"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.4-r1"},{"fixed":"21.1.12-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.1.4-r1"},{"fixed":"21.1.9-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.10-1","2:21.1.11-1","2:21.1.11-2","2:21.1.11-3","2:21.1.12-1","2:21.1.13-1","2:21.1.13-2","2:21.1.13-3","2:21.1.13-3.1","2:21.1.14-1","2:21.1.14-2","2:21.1.15-1","2:21.1.15-2","2:21.1.15-3","2:21.1.16-1","2:21.1.16-1.1","2:21.1.16-1.2","2:21.1.16-1.3","2:21.1.18-1","2:21.1.18-2","2:21.1.20-1","2:21.1.21-1","2:21.1.22-1","2:21.1.23-1","2:21.1.24-1","2:21.1.25-1","2:21.1.25-2","2:21.1.7-3","2:21.1.7-3+deb12u1","2:21.1.7-3+deb12u10","2:21.1.7-3+deb12u11","2:21.1.7-3+deb12u12","2:21.1.7-3+deb12u13","2:21.1.7-3+deb12u2","2:21.1.7-3+deb12u3","2:21.1.7-3+deb12u4","2:21.1.7-3+deb12u5","2:21.1.7-3+deb12u6","2:21.1.7-3+deb12u7","2:21.1.7-3+deb12u8","2:21.1.7-3+deb12u9","2:21.1.8-1","2:21.1.9-1","2:21.1.9-1+hurd.1"]},{"source":"osv","ecosystem":"Debian:13","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.16-1.3","2:21.1.16-1.3+deb13u1","2:21.1.16-1.3+deb13u2","2:21.1.16-1.3+deb13u3","2:21.1.16-1.3+deb13u4","2:21.1.18-1","2:21.1.18-2","2:21.1.20-1","2:21.1.21-1","2:21.1.22-1","2:21.1.23-1","2:21.1.24-1","2:21.1.25-1","2:21.1.25-2"]},{"source":"osv","ecosystem":"Debian:14","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.16-1.3","2:21.1.18-1","2:21.1.18-2","2:21.1.20-1","2:21.1.21-1","2:21.1.22-1","2:21.1.23-1","2:21.1.24-1","2:21.1.25-1","2:21.1.25-2"]},{"source":"osv","ecosystem":"Mageia:8","package":"x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.14-4.4.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.8-7.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:9","package":"x11-server-xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.9-1.1.mga9"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-32.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-33.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-33.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.11-33.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.8-30.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc-icons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc-license","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc-server-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc-server-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc-server-module","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tigervnc-server-module-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.13.1-8.el9"}]}],"bundled":2},{"source":"osv","ecosystem":"Root:Debian:11","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.11-1+deb11u18.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.20.11-1+deb11u18.aikido.13"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.7-3+deb12u13.aikido.9"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:21.1.7-3+deb12u13.aikido.9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-10.56.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-10.56.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.6-10.56.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150500.7.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150400.38.29.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150400.3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.4-150400.3.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.5-150500.7.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.5-150500.7.5.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.3-150200.22.5.79.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.14.3-3ubuntu2","2:1.14.3-3ubuntu3","2:1.14.3-3ubuntu4","2:1.14.3-5ubuntu1","2:1.14.4-1ubuntu1","2:1.14.4-1ubuntu2","2:1.14.4.901-0ubuntu2","2:1.14.5-1ubuntu2","2:1.14.5-1ubuntu4","2:1.15.0-1ubuntu1","2:1.15.0-1ubuntu2","2:1.15.0-1ubuntu3","2:1.15.0-1ubuntu4","2:1.15.0-1ubuntu6","2:1.15.0-1ubuntu7","2:1.15.1-0ubuntu1","2:1.15.1-0ubuntu2","2:1.15.1-0ubuntu2.1","2:1.15.1-0ubuntu2.4","2:1.15.1-0ubuntu2.5","2:1.15.1-0ubuntu2.6","2:1.15.1-0ubuntu2.7","2:1.15.1-0ubuntu2.9","2:1.15.1-0ubuntu2.10","2:1.15.1-0ubuntu2.11","2:1.15.1-0ubuntu2.11+esm2","2:1.15.1-0ubuntu2.11+esm3","2:1.15.1-0ubuntu2.11+esm4","2:1.15.1-0ubuntu2.11+esm5","2:1.15.1-0ubuntu2.11+esm6","2:1.15.1-0ubuntu2.11+esm7","2:1.15.1-0ubuntu2.11+esm8","2:1.15.1-0ubuntu2.11+esm9","2:1.15.1-0ubuntu2.11+esm11","2:1.15.1-0ubuntu2.11+esm12"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.17.2-1ubuntu9","2:1.17.2-1ubuntu10","2:1.17.3-2ubuntu1","2:1.17.3-2ubuntu2","2:1.17.3-2ubuntu3","2:1.17.3-2ubuntu4","2:1.18.1-1ubuntu3","2:1.18.1-1ubuntu4","2:1.18.3-1ubuntu1","2:1.18.3-1ubuntu2","2:1.18.3-1ubuntu2.2","2:1.18.3-1ubuntu2.3","2:1.18.4-0ubuntu0.1","2:1.18.4-0ubuntu0.2","2:1.18.4-0ubuntu0.3","2:1.18.4-0ubuntu0.4","2:1.18.4-0ubuntu0.6","2:1.18.4-0ubuntu0.7","2:1.18.4-0ubuntu0.8","2:1.18.4-0ubuntu0.9","2:1.18.4-0ubuntu0.10","2:1.18.4-0ubuntu0.11","2:1.18.4-0ubuntu0.12","2:1.18.4-0ubuntu0.12+esm1","2:1.18.4-0ubuntu0.12+esm2","2:1.18.4-0ubuntu0.12+esm4","2:1.18.4-0ubuntu0.12+esm5","2:1.18.4-0ubuntu0.12+esm6","2:1.18.4-0ubuntu0.12+esm8","2:1.18.4-0ubuntu0.12+esm9","2:1.18.4-0ubuntu0.12+esm10","2:1.18.4-0ubuntu0.12+esm12","2:1.18.4-0ubuntu0.12+esm13","2:1.18.4-0ubuntu0.12+esm14","2:1.18.4-0ubuntu0.12+esm15","2:1.18.4-0ubuntu0.12+esm16","2:1.18.4-0ubuntu0.12+esm17","2:1.18.4-0ubuntu0.12+esm18"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"xorg-server-hwe-16.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.18.4-1ubuntu6.1~16.04.1","2:1.18.4-1ubuntu6.1~16.04.2","2:1.19.3-1ubuntu1~16.04.2","2:1.19.3-1ubuntu1~16.04.3","2:1.19.3-1ubuntu1~16.04.4","2:1.19.5-0ubuntu2~16.04.1","2:1.19.6-1ubuntu4~16.04.1","2:1.19.6-1ubuntu4.1~16.04.1","2:1.19.6-1ubuntu4.1~16.04.2","2:1.19.6-1ubuntu4.1~16.04.3","2:1.19.6-1ubuntu4.1~16.04.4","2:1.19.6-1ubuntu4.1~16.04.5","2:1.19.6-1ubuntu4.1~16.04.6","2:1.19.6-1ubuntu4.1~16.04.6+esm1","2:1.19.6-1ubuntu4.1~16.04.6+esm3","2:1.19.6-1ubuntu4.1~16.04.6+esm4","2:1.19.6-1ubuntu4.1~16.04.6+esm5","2:1.19.6-1ubuntu4.1~16.04.6+esm6","2:1.19.6-1ubuntu4.1~16.04.6+esm7","2:1.19.6-1ubuntu4.1~16.04.6+esm8","2:1.19.6-1ubuntu4.1~16.04.6+esm9","2:1.19.6-1ubuntu4.1~16.04.6+esm10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.19.5-0ubuntu2","2:1.19.6-1ubuntu1","2:1.19.6-1ubuntu2","2:1.19.6-1ubuntu3","2:1.19.6-1ubuntu4","2:1.19.6-1ubuntu4.1","2:1.19.6-1ubuntu4.2","2:1.19.6-1ubuntu4.3","2:1.19.6-1ubuntu4.4","2:1.19.6-1ubuntu4.5","2:1.19.6-1ubuntu4.6","2:1.19.6-1ubuntu4.7","2:1.19.6-1ubuntu4.8","2:1.19.6-1ubuntu4.9","2:1.19.6-1ubuntu4.10","2:1.19.6-1ubuntu4.11","2:1.19.6-1ubuntu4.12","2:1.19.6-1ubuntu4.13","2:1.19.6-1ubuntu4.14","2:1.19.6-1ubuntu4.15","2:1.19.6-1ubuntu4.15+esm1","2:1.19.6-1ubuntu4.15+esm3","2:1.19.6-1ubuntu4.15+esm4","2:1.19.6-1ubuntu4.15+esm5","2:1.19.6-1ubuntu4.15+esm7","2:1.19.6-1ubuntu4.15+esm8","2:1.19.6-1ubuntu4.15+esm9","2:1.19.6-1ubuntu4.15+esm10","2:1.19.6-1ubuntu4.15+esm11","2:1.19.6-1ubuntu4.15+esm12","2:1.19.6-1ubuntu4.15+esm13"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"xorg-server-hwe-18.04","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.1-3ubuntu2.1~18.04.1","2:1.20.4-1ubuntu3~18.04.1","2:1.20.5+git20191008-0ubuntu1~18.04.1","2:1.20.8-2ubuntu2.1~18.04.1","2:1.20.8-2ubuntu2.2~18.04.1","2:1.20.8-2ubuntu2.2~18.04.2","2:1.20.8-2ubuntu2.2~18.04.3","2:1.20.8-2ubuntu2.2~18.04.4","2:1.20.8-2ubuntu2.2~18.04.5","2:1.20.8-2ubuntu2.2~18.04.6","2:1.20.8-2ubuntu2.2~18.04.7","2:1.20.8-2ubuntu2.2~18.04.8","2:1.20.8-2ubuntu2.2~18.04.9","2:1.20.8-2ubuntu2.2~18.04.10","2:1.20.8-2ubuntu2.2~18.04.11","2:1.20.8-2ubuntu2.2~18.04.11+esm1","2:1.20.8-2ubuntu2.2~18.04.11+esm2","2:1.20.8-2ubuntu2.2~18.04.11+esm3","2:1.20.8-2ubuntu2.2~18.04.11+esm4","2:1.20.8-2ubuntu2.2~18.04.11+esm5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.5+git20191008-0ubuntu1","2:1.20.6-1ubuntu1","2:1.20.7-2ubuntu1","2:1.20.7-2ubuntu2","2:1.20.8-2ubuntu2","2:1.20.8-2ubuntu2.1","2:1.20.8-2ubuntu2.2","2:1.20.8-2ubuntu2.3","2:1.20.8-2ubuntu2.4","2:1.20.8-2ubuntu2.6","2:1.20.9-2ubuntu1.1~20.04.1","2:1.20.9-2ubuntu1.2~20.04.1","2:1.20.9-2ubuntu1.2~20.04.2","2:1.20.11-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.2","2:1.20.13-1ubuntu1~20.04.3","2:1.20.13-1ubuntu1~20.04.4","2:1.20.13-1ubuntu1~20.04.5","2:1.20.13-1ubuntu1~20.04.6","2:1.20.13-1ubuntu1~20.04.8","2:1.20.13-1ubuntu1~20.04.9","2:1.20.13-1ubuntu1~20.04.12","2:1.20.13-1ubuntu1~20.04.14","2:1.20.13-1ubuntu1~20.04.15","2:1.20.13-1ubuntu1~20.04.16","2:1.20.13-1ubuntu1~20.04.17","2:1.20.13-1ubuntu1~20.04.18","2:1.20.13-1ubuntu1~20.04.19","2:1.20.13-1ubuntu1~20.04.20","2:1.20.13-1ubuntu1~20.04.20+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:1.20.13-1ubuntu1","2:1.20.13-1ubuntu2","2:1.20.14-1ubuntu1","2:21.1.3-2ubuntu2","2:21.1.3-2ubuntu2.1","2:21.1.3-2ubuntu2.2","2:21.1.3-2ubuntu2.3","2:21.1.3-2ubuntu2.4","2:21.1.3-2ubuntu2.5","2:21.1.3-2ubuntu2.6","2:21.1.3-2ubuntu2.7","2:21.1.3-2ubuntu2.8","2:21.1.3-2ubuntu2.9","2:21.1.4-2ubuntu1.7~22.04.1","2:21.1.4-2ubuntu1.7~22.04.2","2:21.1.4-2ubuntu1.7~22.04.5","2:21.1.4-2ubuntu1.7~22.04.7","2:21.1.4-2ubuntu1.7~22.04.8","2:21.1.4-2ubuntu1.7~22.04.9","2:21.1.4-2ubuntu1.7~22.04.10","2:21.1.4-2ubuntu1.7~22.04.11","2:21.1.4-2ubuntu1.7~22.04.12","2:21.1.4-2ubuntu1.7~22.04.13","2:21.1.4-2ubuntu1.7~22.04.14","2:21.1.4-2ubuntu1.7~22.04.15","2:21.1.4-2ubuntu1.7~22.04.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.7-3ubuntu2","2:21.1.7-3ubuntu2.1","2:21.1.10-1ubuntu1","2:21.1.11-2ubuntu1","2:21.1.12-1ubuntu1","2:21.1.12-1ubuntu1.1","2:21.1.12-1ubuntu1.2","2:21.1.12-1ubuntu1.3","2:21.1.12-1ubuntu1.4","2:21.1.12-1ubuntu1.5","2:21.1.12-1ubuntu1.6","2:21.1.12-1ubuntu1.8","2:21.1.12-1ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.16-1ubuntu1","2:21.1.18-1ubuntu1","2:21.1.18-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.22-1ubuntu1","2:21.1.22-1ubuntu4","2:21.1.24-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"xorg-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.18-1ubuntu1","2:21.1.21-1ubuntu1","2:21.1.22-1ubuntu1","2:21.1.22-1ubuntu1.2","2:21.1.22-1ubuntu1.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xorg-x11-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.1.9-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xwayland","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.2.2-2.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"x.org","product":"x_server"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:2298","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5574","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244735","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://lists.x.org/archives/xorg-announce/2023-October/003430.html","tags":["x_transferred","Patch","Vendor Advisory","fix","article"]},{"url":"https://security.netapp.com/advisory/ntap-20231130-0004/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5574","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20231130-0004"},{"url":"https://github.com/advisories/GHSA-79x6-r5x5-fvqw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-5574","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5380","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244735","tags":["report"]},{"url":"https://bugzilla.redhat.com/2244736","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2298.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-5574","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-5574","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0307.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32453","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2023/10/25/1","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2261","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2314","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2315","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2316","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2317","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244736","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2298.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5380","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5380","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5574","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234269-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216133","tags":["report"]},{"url":"https://bugzilla.suse.com/1216135","tags":["report"]},{"url":"https://bugzilla.suse.com/1216261","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5574","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234272-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234292-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234293-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234306-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234338-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-5574","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-5574","title":"Xorg-x11-server: use-after-free bug in damagedestroy","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","status":"published","published":"2023-10-25T19:47:03.122Z","modified":"2026-11-04T21:06:07.239Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2023-57870","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","status":"published","published":"2023-10-25T19:47:03Z","modified":"2026-11-04T21:06:07Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-04T22:46:32.144626Z"}],"ghsa":[{"id":"GHSA-79x6-r5x5-fvqw","title":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very...","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","status":"published","published":"2023-10-25T21:30:33Z","modified":"2024-05-10T05:03:03Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:57:20.80512Z"}],"nvd":[{"id":"CVE-2023-5574","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","status":"published","published":"2023-10-25T20:15:18.717Z","modified":"2026-11-04T21:17:25.273Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-04T23:43:36.946093Z"}],"osv":[{"id":"ALPINE-CVE-2023-5574","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","status":"published","published":"2023-10-25T20:15:18.717Z","modified":"2026-11-03T06:32:44.072471626Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:02.90744Z"},{"id":"AZL-31703","title":"CVE-2023-5574 affecting package xorg-x11-server for versions less than 1.20.10-10","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","status":"published","published":"2023-10-25T20:15:18Z","modified":"2026-04-21T04:26:28.816438Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-45255","title":"CVE-2023-5574 affecting package xorg-x11-server 1.20.10-6","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","status":"published","published":"2023-10-25T20:15:18Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:20.321068Z"},{"id":"BELL-CVE-2023-5574","status":"published","published":"2023-10-26T06:01:21.16565Z","modified":"2026-01-26T09:34:38.479491Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:19.288949Z"},{"id":"CVE-2023-5574","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","status":"published","published":"2023-10-25T20:15:18.717Z","modified":"2026-04-16T04:37:26.502866438Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:36.851042Z"},{"id":"DEBIAN-CVE-2023-5574","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","status":"published","published":"2023-10-25T20:15:18.717Z","modified":"2026-11-05T09:47:25.984063697Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:49.170436Z"},{"id":"OESA-2024-2261","title":"xorg-x11-server security update","description":"X.Org X11 X server\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.(CVE-2023-5574)","status":"published","published":"2024-10-18T11:07:44Z","modified":"2026-08-18T01:17:34.730105915Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2314","title":"xorg-x11-server security update","description":"X.Org X11 X server\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.(CVE-2023-5574)","status":"published","published":"2024-11-01T11:07:47Z","modified":"2026-08-18T01:17:37.293945776Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2315","title":"xorg-x11-server security update","description":"X.Org X11 X server\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.(CVE-2023-5574)","status":"published","published":"2024-11-01T11:07:47Z","modified":"2026-08-18T01:17:36.3151891Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2316","title":"xorg-x11-server security update","description":"X.Org X11 X server\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.(CVE-2023-5574)","status":"published","published":"2024-11-01T11:07:47Z","modified":"2026-08-18T01:17:36.003083504Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2317","title":"xorg-x11-server security update","description":"X.Org X11 X server\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.(CVE-2023-5574)","status":"published","published":"2024-11-01T11:07:47Z","modified":"2026-08-18T01:17:37.269395449Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"RHSA-2024:2298","title":"Red Hat Security Advisory: tigervnc security update","status":"published","published":"2024-09-16T17:03:14Z","modified":"2026-07-12T10:02:41Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2023-5574","title":"CVE-2023-5574 in xorg-server - Patched by Root","description":"Root has patched CVE-2023-5574 in the xorg-server package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-10-09T10:36:01Z","modified":"2026-10-09T11:15:02.60650754Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:28.80888Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2023-5574","title":"CVE-2023-5574 in xorg-server - Patched by Root","description":"Root has patched CVE-2023-5574 in the xorg-server package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-09-09T10:31:43Z","modified":"2026-09-09T11:15:04.079930315Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:30.70924Z"},{"id":"UBUNTU-CVE-2023-5574","description":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","status":"published","published":"2023-10-25T00:00:00Z","modified":"2026-10-19T23:30:06.787075231Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"ALSA-2024:2298","title":"Important: tigervnc security update","description":"Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients.\n\nSecurity Fix(es):\n\n* xorg-x11-server: Use-after-free bug in DamageDestroy (CVE-2023-5574)\n* xorg-x11-server: Use-after-free bug in DestroyWindow (CVE-2023-5380)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:08.36607882Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"MGASA-2023-0307","title":"Updated x11-server packages fix security vulnerabilities","description":"The updated packages fix security vulnerabilities:\n\nOOB write in XIChangeDeviceProperty/RRChangeOutputProperty.\n(CVE-2023-5367)\n\nUse-after-free bug in DestroyWindow. (CVE-2023-5380)\n\nUse-after-free bug in DamageDestroy. (CVE-2023-5574)\n","status":"published","published":"2023-11-06T23:08:32Z","modified":"2026-04-16T04:42:01.552186945Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13361-1","title":"xorg-x11-server-21.1.9-1.1 on GA media","description":"These are all security issues fixed in the xorg-x11-server-21.1.9-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:20:52.74421Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13467-1","title":"xwayland-23.2.2-2.1 on GA media","description":"These are all security issues fixed in the xwayland-23.2.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:31:36.094641Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4269-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2023-5574: Fixed a privilege escalation issue that could be\n  triggered via the Damage extension protocol (bsc#1216261).\n- CVE-2023-5380: Fixed a memory safety issue that could be triggered\n  when using multiple protocol screens (bsc#1216133).\n- CVE-2023-5367: Fixed a memory safety issue in both the XI2 and RandR\n  protocols (bsc#1216135).\n","status":"published","published":"2023-10-30T16:40:38Z","modified":"2026-02-04T04:17:54.656317Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4272-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2023-5574: Fixed a privilege escalation issue that could be\n  triggered via the Damage extension protocol (bsc#1216261).\n- CVE-2023-5380: Fixed a memory safety issue that could be triggered\n  when using multiple protocol screens (bsc#1216133).\n- CVE-2023-5367: Fixed a memory safety issue in both the XI2 and RandR\n  protocols (bsc#1216135).\n","status":"published","published":"2023-10-30T17:29:42Z","modified":"2026-02-04T02:23:51.82629Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4292-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2023-5574: Fixed a privilege escalation issue that could be\n  triggered via the Damage extension protocol (bsc#1216261).\n- CVE-2023-5380: Fixed a memory safety issue that could be triggered\n  when using multiple protocol screens (bsc#1216133).\n- CVE-2023-5367: Fixed a memory safety issue in both the XI2 and RandR\n  protocols (bsc#1216135).\n","status":"published","published":"2023-10-31T08:21:57Z","modified":"2026-02-04T03:23:16.791245Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4293-1","title":"Security update for xwayland","description":"This update for xwayland fixes the following issues:\n\n- CVE-2023-5574: Fixed a privilege escalation issue that could be\n  triggered via the Damage extension protocol (bsc#1216261).\n- CVE-2023-5367: Fixed a memory safety issue in both the XI2 and RandR\n  protocols (bsc#1216135).\n","status":"published","published":"2023-10-31T08:22:55Z","modified":"2026-02-04T02:27:57.270604Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4306-1","title":"Security update for xwayland","description":"This update for xwayland fixes the following issues:\n\n- CVE-2023-5574: Fixed a privilege escalation issue that could be\n  triggered via the Damage extension protocol (bsc#1216261).\n- CVE-2023-5367: Fixed a memory safety issue in both the XI2 and RandR\n  protocols (bsc#1216135).\n","status":"published","published":"2023-10-31T10:37:03Z","modified":"2026-02-04T04:36:38.921251Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4338-1","title":"Security update for xorg-x11-server","description":"This update for xorg-x11-server fixes the following issues:\n\n- CVE-2023-5574: Fixed a privilege escalation issue that could be\n  triggered via the Damage extension protocol (bsc#1216261).\n- CVE-2023-5380: Fixed a memory safety issue that could be triggered\n  when using multiple protocol screens (bsc#1216133).\n- CVE-2023-5367: Fixed a memory safety issue in both the XI2 and RandR\n  protocols (bsc#1216135).\n","status":"published","published":"2023-11-02T09:10:13Z","modified":"2026-02-04T04:02:55.865243Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}