CVE-2023-5380

MEDIUM EPSS 49.1%
Published Oct 25, 20232y ago · Modified Jun 23, 20261w ago
4.7 CVSS 3.1
Medium
Find Similar
Published Oct 25, 2023 2y ago
Last Modified Jun 23, 2026 1w ago

Description

A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed.

CVSS Details

Base Score
4.7
Exploitability
1.0
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
49.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 10

VendorProductVersionRange
x.orgx_server* <21.1.9
x.orgxwayland* <23.2.2
redhatenterprise_linux7.0any
redhatenterprise_linux8.0any
redhatenterprise_linux9.0any
fedoraprojectfedora37any
fedoraprojectfedora38any
fedoraprojectfedora39any
debiandebian_linux11.0any
debiandebian_linux12.0any

References 18

  • access.redhat.com https://access.redhat.com/errata/RHSA-2023:7428
    Third Party Advisory
  • access.redhat.com https://access.redhat.com/errata/RHSA-2024:2169
  • access.redhat.com https://access.redhat.com/errata/RHSA-2024:2298
  • access.redhat.com https://access.redhat.com/errata/RHSA-2024:2995
  • access.redhat.com https://access.redhat.com/errata/RHSA-2024:3067
  • access.redhat.com https://access.redhat.com/security/cve/CVE-2023-5380
    Third Party Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2244736
    Issue Tracking
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2023/10/msg00036.html
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/
  • lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/
  • lists.x.org https://lists.x.org/archives/xorg-announce/2023-October/003430.html
    PatchVendor Advisory
  • security.gentoo.org https://security.gentoo.org/glsa/202401-30
  • security.netapp.com https://security.netapp.com/advisory/ntap-20231130-0004/
  • debian.org https://www.debian.org/security/2023/dsa-5534

Remediation

  • lists.x.org https://lists.x.org/archives/xorg-announce/2023-October/003430.html
    PatchVendor Advisory