{"id":"DEBIAN-CVE-2023-5574","details":"A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.","modified":"2026-09-15T09:02:53.602377645Z","published":"2023-10-25T20:15:18.717Z","upstream":["CVE-2023-5574"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2023-5574"}],"affected":[{"package":{"name":"xorg-server","ecosystem":"Debian:12","purl":"pkg:deb/debian/xorg-server?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.10-1","2:21.1.11-1","2:21.1.11-2","2:21.1.11-3","2:21.1.12-1","2:21.1.13-1","2:21.1.13-2","2:21.1.13-3","2:21.1.13-3.1","2:21.1.14-1","2:21.1.14-2","2:21.1.15-1","2:21.1.15-2","2:21.1.15-3","2:21.1.16-1","2:21.1.16-1.1","2:21.1.16-1.2","2:21.1.16-1.3","2:21.1.18-1","2:21.1.18-2","2:21.1.20-1","2:21.1.21-1","2:21.1.22-1","2:21.1.23-1","2:21.1.24-1","2:21.1.7-3","2:21.1.7-3+deb12u1","2:21.1.7-3+deb12u10","2:21.1.7-3+deb12u11","2:21.1.7-3+deb12u12","2:21.1.7-3+deb12u13","2:21.1.7-3+deb12u2","2:21.1.7-3+deb12u3","2:21.1.7-3+deb12u4","2:21.1.7-3+deb12u5","2:21.1.7-3+deb12u6","2:21.1.7-3+deb12u7","2:21.1.7-3+deb12u8","2:21.1.7-3+deb12u9","2:21.1.8-1","2:21.1.9-1","2:21.1.9-1+hurd.1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5574.json"}},{"package":{"name":"xorg-server","ecosystem":"Debian:13","purl":"pkg:deb/debian/xorg-server?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.16-1.3","2:21.1.16-1.3+deb13u1","2:21.1.16-1.3+deb13u2","2:21.1.16-1.3+deb13u3","2:21.1.16-1.3+deb13u4","2:21.1.18-1","2:21.1.18-2","2:21.1.20-1","2:21.1.21-1","2:21.1.22-1","2:21.1.23-1","2:21.1.24-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5574.json"}},{"package":{"name":"xorg-server","ecosystem":"Debian:14","purl":"pkg:deb/debian/xorg-server?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:21.1.16-1.3","2:21.1.18-1","2:21.1.18-2","2:21.1.20-1","2:21.1.21-1","2:21.1.22-1","2:21.1.23-1","2:21.1.24-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2023-5574.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}