CVE-2023-5574

low-risk
Published 2023-10-25

A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.0/10 High
LOCAL / HIGH complexity

Affected Products (2)

Affected Vendors

Redhat X.Org

References (9)

https://access.redhat.com/errata/RHSA-2024:2298
Third Party Advisory https://access.redhat.com/security/cve/CVE-2023-5574
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2244735
Patch https://lists.x.org/archives/xorg-announce/2023-October/003430.html
https://access.redhat.com/errata/RHSA-2024:2298
Third Party Advisory https://access.redhat.com/security/cve/CVE-2023-5574
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=2244735
Patch https://lists.x.org/archives/xorg-announce/2023-October/003430.html
https://security.netapp.com/advisory/ntap-20231130-0004/
25
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 7/34 · Low