CVE-2023-5380

Published: Oct 25, 2023Modified: Jun 23, 2026

4.7

Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 1.0 / Impact: 3.6

Source: NVD

Description

A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed.

Affected (10)

Products: X.org: X Server, Xwayland · Redhat: Enterprise Linux · Fedoraproject: Fedora · +1 more

Show all products

X.org: X Server, Xwayland · Redhat: Enterprise Linux · Fedoraproject: Fedora · Debian: Debian Linux

2 products

1 product

Enterprise Linux

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
X.org X Server	Before 21.1.9
X.org Xwayland	Before 23.2.2

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0
Redhat Enterprise Linux	Version 9.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 37
Fedoraproject Fedora	Version 38
Fedoraproject Fedora	Version 39

Configuration D

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 12.0

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (26)

https://access.redhat.com/errata/RHSA-2023:7428

Source: secalert@redhat.com

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:2169

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2024:2298

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2024:2995

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2024:3067

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2023-5380

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2244736

Source: secalert@redhat.com

Issue Tracking

https://lists.x.org/archives/xorg-announce/2023-October/003430.html

Source: secalert@redhat.com

PatchVendor Advisory

https://access.redhat.com/errata/RHSA-2023:7428

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2024:2169

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2024:2298

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2024:2995

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/errata/RHSA-2024:3067

Source: af854a3a-2127-422b-91ae-364da2661108

https://access.redhat.com/security/cve/CVE-2023-5380

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=2244736

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://lists.debian.org/debian-lts-announce/2023/10/msg00036.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2WS5E7H4A5J3U5YBCTMRPQVGWK5LVH7D/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3RK66CXMXO3PCPDU3GDY5FK4UYHUXQJT/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AKKIE626TZOOPD533EYN47J4RFNHZVOP/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HO2Q2NP6R62ZRQQG3XQ4AXUT7J2EKKKY/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SN6KV4XGQJRVAOSM5C3CWMVAXO53COIP/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TJXNI4BXURC2BKPNAHFJK3C5ZETB7PER/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.x.org/archives/xorg-announce/2023-October/003430.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://security.gentoo.org/glsa/202401-30

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.netapp.com/advisory/ntap-20231130-0004/

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.debian.org/security/2023/dsa-5534

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.