CVE-2023-5574

HIGH EPSS 41.1%
Published Oct 25, 20232y ago · Modified Jun 23, 20261w ago
7.0 CVSS 3.1
High
Find Similar
Published Oct 25, 2023 2y ago
Last Modified Jun 23, 2026 1w ago

Description

A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

CVSS Details

Base Score
7.0
Exploitability
1.0
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
41.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-416 Use After Free Memory Safety

Affected Products 2

VendorProductVersionRange
x.orgx_server*≥1.13.0
redhatenterprise_linux7.0any

References 5

  • access.redhat.com https://access.redhat.com/errata/RHSA-2024:2298
  • access.redhat.com https://access.redhat.com/security/cve/CVE-2023-5574
    Third Party Advisory
  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=2244735
    Issue TrackingThird Party Advisory
  • lists.x.org https://lists.x.org/archives/xorg-announce/2023-October/003430.html
    PatchVendor Advisory
  • security.netapp.com https://security.netapp.com/advisory/ntap-20231130-0004/

Remediation

  • lists.x.org https://lists.x.org/archives/xorg-announce/2023-October/003430.html
    PatchVendor Advisory