FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

xorg-server -- Overlay Window Use-After-Free

Affected packages
		xephyr	<	21.1.8,1
		xorg-server	<	21.1.8,1
		xorg-vfbserver	<	21.1.8,1
		xorg-nestserver	<	21.1.8,2
23.0.0,1	<=	xwayland	<	23.1.1,1
		xwayland	<	22.1.9,1
		xwayland-devel	<	21.0.99.1.439

Details

VuXML ID	96d84238-b500-490b-b6aa-2b77090a0410
Discovery	2023-03-29
Entry	2023-03-29

The X.Org project reports:

ZDI-CAN-19866/CVE-2023-1393: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later.

[source]

References

CVE Name	CVE-2023-1393
URL	https://lists.x.org/archives/xorg-announce/2023-March/003374.html