A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.

The remote Redhat Enterprise Linux 9 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - xorg-x11-server: Use-after-free bug in DamageDestroy (CVE-2023-5574)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - xorg-x11-server: Use-after-free bug in DamageDestroy (CVE-2023-5574)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-2298 advisory.

    - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice       Resolves: RHEL-20389
    - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent       Resolves: RHEL-20383
    - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-     bounds memory access       Resolves: RHEL-20533
    - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and     ProcXIQueryPointer       Resolves: RHEL-21213
    - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions       Resolves: RHEL-18414
    - Fix CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and     RRChangeProviderProperty       Resolves: RHEL-18426
    - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow       Resolves: RHEL-15237

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2298 advisory.

    Virtual Network Computing (VNC) is a remote display system which allows users to view a computing desktop     environment not only on the machine where it is running, but from anywhere on the Internet and from a wide     variety of machine architectures. TigerVNC is a suite of VNC servers and clients.

    Security Fix(es):

    * xorg-x11-server: Use-after-free bug in DamageDestroy (CVE-2023-5574)

    * xorg-x11-server: Use-after-free bug in DestroyWindow (CVE-2023-5380)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.4 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-444 advisory.

  - A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific     and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode).
    If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during     shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
    (CVE-2023-5574)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1892 advisory.

  - A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific     and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode).
    If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during     shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
    (CVE-2023-5574)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2352 advisory.

  - A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific     and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode).
    If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during     shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
    (CVE-2023-5574)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4338-1 advisory.

  - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect     calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function     in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible     escalation of privileges or denial of service. (CVE-2023-5367)

  - A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and     legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if     the pointer is warped from within a window on one screen to the root window of the other screen and if the     original window is destroyed followed by another window being destroyed. (CVE-2023-5380)

  - A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific     and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode).
    If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during     shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
    (CVE-2023-5574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4306-1 advisory.

  - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect     calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function     in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible     escalation of privileges or denial of service. (CVE-2023-5367)

  - A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific     and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode).
    If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during     shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
    (CVE-2023-5574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4293-1 advisory.

  - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect     calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function     in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible     escalation of privileges or denial of service. (CVE-2023-5367)

  - A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific     and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode).
    If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during     shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
    (CVE-2023-5574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4292-1 advisory.

  - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect     calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function     in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible     escalation of privileges or denial of service. (CVE-2023-5367)

  - A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and     legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if     the pointer is warped from within a window on one screen to the root window of the other screen and if the     original window is destroyed followed by another window being destroyed. (CVE-2023-5380)

  - A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific     and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode).
    If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during     shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
    (CVE-2023-5574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4272-1 advisory.

  - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect     calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function     in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible     escalation of privileges or denial of service. (CVE-2023-5367)

  - A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and     legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if     the pointer is warped from within a window on one screen to the root window of the other screen and if the     original window is destroyed followed by another window being destroyed. (CVE-2023-5380)

  - A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific     and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode).
    If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during     shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
    (CVE-2023-5574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:4269-1 advisory.

  - A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect     calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function     in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible     escalation of privileges or denial of service. (CVE-2023-5367)

  - A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and     legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if     the pointer is warped from within a window on one screen to the root window of the other screen and if the     original window is destroyed followed by another window being destroyed. (CVE-2023-5380)

  - A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific     and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode).
    If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during     shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
    (CVE-2023-5574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
199742	RHEL 9 : tigervnc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199726	RHEL 8 : tigervnc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
195074	Oracle Linux 9 : tigervnc (ELSA-2024-2298)	Nessus	Oracle Linux Local Security Checks	high
194764	RHEL 9 : tigervnc (RHSA-2024:2298)	Nessus	Red Hat Local Security Checks	high
186984	Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2023-444)	Nessus	Amazon Linux Local Security Checks	high
186588	Amazon Linux AMI : xorg-x11-server (ALAS-2023-1892)	Nessus	Amazon Linux Local Security Checks	high
186561	Amazon Linux 2 : xorg-x11-server (ALAS-2023-2352)	Nessus	Amazon Linux Local Security Checks	high
184341	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xorg-x11-server (SUSE-SU-2023:4338-1)	Nessus	SuSE Local Security Checks	high
184117	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xwayland (SUSE-SU-2023:4306-1)	Nessus	SuSE Local Security Checks	high
184114	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xwayland (SUSE-SU-2023:4293-1)	Nessus	SuSE Local Security Checks	high
184113	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xorg-x11-server (SUSE-SU-2023:4292-1)	Nessus	SuSE Local Security Checks	high
184069	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : xorg-x11-server (SUSE-SU-2023:4272-1)	Nessus	SuSE Local Security Checks	high
184066	SUSE SLES12 Security Update : xorg-x11-server (SUSE-SU-2023:4269-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2023-5574

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high