Description
A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | xorg-server | xorg-server 21.1.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xorg-server | 2:21.1.7-2 | — |
| Debian 14 | xwayland | 2:22.1.9-1 | — |
| Debian 13 | xorg-server | 2:21.1.7-2 | — |
| Debian 13 | xwayland | 2:22.1.9-1 | — |
| Debian 12 | xorg-server | 2:21.1.7-2 | — |
| Debian 12 | xwayland | 2:22.1.9-1 | — |
| Debian 11 | xorg-server | 2:1.20.11-1+deb11u6 | DSA-5380-1 |
| Debian 10 | xorg-server | 2:1.20.4-1+deb10u9 | DLA-3372-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | tigervnc | 1.12.0+dfsg-4ubuntu0.22.04.1 | — |
| Ubuntu 22.04 LTS | xorg-server | 2:21.1.3-2ubuntu2.9 | USN-5986-1 |
| Ubuntu 22.04 LTS | xwayland | 2:22.1.1-1ubuntu0.6 | USN-5986-1 |
| Ubuntu 20.04 LTS | tigervnc | 1.10.1+dfsg-3ubuntu0.20.04.1 | — |
| Ubuntu 20.04 LTS | xorg-server | 2:1.20.13-1ubuntu1~20.04.8 | USN-5986-1 |
| Ubuntu 18.04 LTS | xorg-server | 2:1.19.6-1ubuntu4.15 | USN-5986-1 |
| Ubuntu 18.04 LTS | xorg-server-hwe-18.04 | 2:1.20.8-2ubuntu2.2~18.04.11 | USN-5986-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | tigervnc | No fix yet | — |
| Ubuntu Pro 16.04 LTS | xorg-server +1 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | xorg-server | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | tigervnc +6 | 1.12.0-5.el9_1.2 | RHSA-2023:1592 |
| RHEL 9 | xorg-x11-server +8 | 1.20.11-19.el9 | RHSA-2023:6340 |
| RHEL 9 | xorg-x11-server-Xwayland | 22.1.9-2.el9 | RHSA-2023:6341 |
| RHEL 8 | tigervnc +6 | 1.12.0-9.el8_7.3 | RHSA-2023:1551 |
| RHEL 8 | xorg-x11-server +8 | 1.20.11-17.el8 | RHSA-2023:6916 |
| RHEL 8 | xorg-x11-server-Xwayland | 21.1.3-12.el8 | RHSA-2023:6917 |
| RHEL 7 | tigervnc +6 | 1.8.0-25.el7_9 | RHSA-2023:1594 |
| RHEL 7 | xorg-x11-server +9 | 1.20.4-23.el7_9 | RHSA-2023:1594 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.0 EUS | tigervnc +6 | 1.11.0-22.el9_0.2 | RHSA-2023:1599 |
| RHEL 8.6 EUS | tigervnc +6 | 1.12.0-6.el8_6.3 | RHSA-2023:1598 |
| RHEL 8.4 EUS | tigervnc +6 | 1.11.0-8.el8_4.2 | RHSA-2023:1548 |
| RHEL 8.2 TUS | tigervnc +6 | 1.9.0-15.el8_2.3 | RHSA-2023:1549 |
| RHEL 8.2 E4S | tigervnc +6 | 1.9.0-15.el8_2.3 | RHSA-2023:1549 |
| RHEL 8.2 AUS | tigervnc +6 | 1.9.0-15.el8_2.3 | RHSA-2023:1549 |
| RHEL 8.1 E4S | tigervnc +6 | 1.9.0-16.el8_1.3 | RHSA-2023:1600 |
| RHEL 6 ELS | tigervnc +3 | 1.1.0-25.el6_10.13 | RHSA-2025:12751 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | tigervnc +6 | 1.12.0-5.el9_1.2 | ALSA-2023:1592 |
| AlmaLinux 9 | xorg-x11-server-Xdmx +7 | 1.20.11-19.el9 | ALSA-2023:6340 |
| AlmaLinux 9 | xorg-x11-server-Xwayland | 22.1.9-2.el9 | ALSA-2023:6341 |
| AlmaLinux 8 | tigervnc +6 | 1.12.0-9.el8_7.3 | ALSA-2023:1551 |
| AlmaLinux 8 | xorg-x11-server-Xdmx +7 | 1.20.11-17.el8 | ALSA-2023:6916 |
| AlmaLinux 8 | xorg-x11-server-Xwayland | 21.1.3-12.el8 | ALSA-2023:6917 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | tigervnc | 1.12.0-5.el9_1.2 | RLSA-2023:1592 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1, SUSE-SU-2023:1675-1 |
| SLES 15 SP4 | xwayland | 21.1.4-150400.3.15.1 | SUSE-SU-2023:1716-1 |
| SLES 15 SP3 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1 |
| SLES 15 SP2 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1 |
| SLES 15 SP1 | xorg-x11-server | 1.20.3-150100.14.5.42.1 | SUSE-SU-2023:1679-1 |
| SLES 12 SP5 | xorg-x11-server | 1.19.6-10.49.1 | SUSE-SU-2023:1677-1 |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | xorg-x11-server | 1.19.6-4.48.1 | SUSE-SU-2023:1674-1 |
| SLES 12 SP2 | xorg-x11-server | 7.6_1.18.3-76.66.1 | SUSE-SU-2023:1680-1 |
| SLES for SAP 15 SP3 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1 |
| SLES for SAP 15 SP2 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1 |
| SLES for SAP 15 SP1 | xorg-x11-server | 1.20.3-150100.14.5.42.1 | SUSE-SU-2023:1679-1 |
| SLES for SAP 12 SP5 | xorg-x11-server | 1.19.6-10.49.1 | SUSE-SU-2023:1677-1 |
| SLES for SAP 12 SP4 | xorg-x11-server | 1.19.6-4.48.1 | SUSE-SU-2023:1674-1 |
| SLE Real Time 15 SP3 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1 |
| SLE HPC 15 SP3 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1 |
| SLE HPC 15 SP2 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1 |
| SLE HPC 15 SP1 | xorg-x11-server | 1.20.3-150100.14.5.42.1 | SUSE-SU-2023:1679-1 |
| SUSE OpenStack Cloud Crowbar 9 | xorg-x11-server | 1.19.6-4.48.1 | SUSE-SU-2023:1674-1 |
| SUSE OpenStack Cloud 9 | xorg-x11-server | 1.19.6-4.48.1 | SUSE-SU-2023:1674-1 |
| SUSE Manager Server 4.2 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1 |
| SUSE Manager Proxy 4.2 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1 |
| SUSE Enterprise Storage 7.1 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1 |
| SUSE Enterprise Storage 7 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xorg-x11-server | 21.1.7-2.1 | openSUSE-SU-2024:12827-1 |
| openSUSE Tumbleweed | xwayland | 23.1.1-1.1 | openSUSE-SU-2024:12834-1 |
| openSUSE Leap 15.4 | xorg-x11-server | 1.20.3-150200.22.5.72.1 | SUSE-SU-2023:1678-1, SUSE-SU-2023:1675-1 |
| openSUSE Leap 15.4 | xwayland | 21.1.4-150400.3.15.1 | SUSE-SU-2023:1716-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | xorg-x11-server | 1.20.10-4 | — |
| Azure Linux 2 (CBL-Mariner) | xorg-x11-server | 1.20.10-4 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | tigervnc +6 | 1.12.0-5.el9_1.2 | ELSA-2023-1592 |
| Oracle Linux 9 | xorg-x11-server-Xdmx +7 | 1.20.11-19.el9 | ELSA-2023-6340 |
| Oracle Linux 9 | xorg-x11-server-Xwayland | 22.1.9-2.el9 | ELSA-2023-6341 |
| Oracle Linux 8 | tigervnc +6 | 1.12.0-9.el8_7.3 | ELSA-2023-1551 |
| Oracle Linux 8 | xorg-x11-server-Xdmx +7 | 1.20.11-17.el8 | ELSA-2023-6916 |
| Oracle Linux 8 | xorg-x11-server-Xwayland | 21.1.3-12.el8 | ELSA-2023-6917 |
| Oracle Linux 7 | tigervnc +6 | 1.8.0-25.el7_9 | ELSA-2023-1594 |
| Oracle Linux 7 | xorg-x11-server-Xdmx +8 | 1.20.4-23.el7_9 | ELSA-2023-1594 |
Advisories 45
- ALSA-2023:6341 Moderate: xorg-x11-server-Xwayland security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:6340 Moderate: xorg-x11-server security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:1592 Important: tigervnc security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:6916 Moderate: xorg-x11-server security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:6917 Moderate: xorg-x11-server-Xwayland security and bug fix update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2023:1551 Important: tigervnc security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2025:12751 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- WID-SEC-2023-2917 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 30, 2026
- RHSA-2023:6340 Red Hat Security Advisory: xorg-x11-server security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2023:1594 Red Hat Security Advisory: tigervnc and xorg-x11-server security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2023:6916 Red Hat Security Advisory: xorg-x11-server security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-5986-1 xorg-server, xorg-server-hwe-18.04, xwayland vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- DSA-5380-1 xorg-server - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3372-1 xorg-server - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2023:1592 Important: tigervnc security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2023:1679-1 Security update for xorg-x11-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1680-1 Security update for xorg-x11-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1716-1 Security update for xwayland SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12834-1 xwayland-23.1.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1678-1 Security update for xorg-x11-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1677-1 Security update for xorg-x11-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1674-1 Security update for xorg-x11-server SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1675-1 Security update for xorg-x11-server SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12827-1 xorg-x11-server-21.1.7-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2026-0031 Kwetsbaarheden verholpen in Oracle JD Edwards NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0169 Oracle JD Edwards: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- RHSA-2023:6917 Red Hat Security Advisory: xorg-x11-server-Xwayland security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:6341 Red Hat Security Advisory: xorg-x11-server-Xwayland security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:1600 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:1599 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:1598 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:1592 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:1549 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:1551 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:1548 Red Hat Security Advisory: tigervnc security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2023-0793 X.Org X11: Schwachstelle ermöglicht Privilegieneskalation oder Codeausführung BSI CERT-Bund (WID) · Aug 4, 2025
- ICSA-24-046-11 Siemens SCALANCE XCM-/XRM-300 CISA ICS & IT advisories · Feb 13, 2024
- SSA-806742 SSA-806742: Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4 Siemens ProductCERT · Feb 13, 2024
- ELSA-2023-6916 Moderate: xorg-x11-server security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 17, 2023
- ELSA-2023-6917 Moderate: xorg-x11-server-Xwayland security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 17, 2023
- ELSA-2023-6341 Moderate: xorg-x11-server-Xwayland security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2023
- ELSA-2023-6340 Moderate: xorg-x11-server security and bug fix update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 11, 2023
- ELSA-2023-1592 Important: tigervnc security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Apr 4, 2023
- ELSA-2023-1551 Important: tigervnc security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Apr 4, 2023
- ELSA-2023-1594 Important: tigervnc and xorg-x11-server security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 4, 2023
References
- https://www.openwall.com/lists/oss-security/2023/03/29/1
- FEDORA-2023-eb3c27ff25 vendor-advisory
- FEDORA-2023-b7835960ac vendor-advisory
- FEDORA-2023-b87fd3a628 vendor-advisory
- FEDORA-2023-f754e7abfd vendor-advisory
- FEDORA-2023-66d5af0278 vendor-advisory
- FEDORA-2023-239bae4b57 vendor-advisory
- FEDORA-2023-fe18ae3e85 vendor-advisory
- FEDORA-2023-6f3f9ee721 vendor-advisory
- GLSA-202305-30 vendor-advisory
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/26ef545b3502f61ca722a7a3373507e88ef64110