A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-free scenario when the same glyph pointer is subsequently accessed. This flaw allows an authenticated attacker to execute arbitrary code on the system by sending a specially crafted request.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tigervnc-server-minimalUpgrade tigervnc-iconsUpgrade xorg-x11-server-develUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade tigervnc-selinuxUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xwayland-develUpgrade tigervncUpgrade tigervnc-licenseUpgrade tigervnc-serverUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-server-module | Apr 30, 2024 | Apr 5, 2024 |
| Alpine Linux | — | Upgrade xorg-serverUpgrade xwayland | Aug 22, 2024 | Apr 5, 2024 |
| Amazon Linux Ami 2 | — | Upgrade tigervnc-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-iconsUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-commonUpgrade tigervnc-server-appletUpgrade tigervnc-serverUpgrade xorg-x11-server-XephyrUpgrade tigervnc-licenseUpgrade xorg-x11-server-XdmxUpgrade tigervncUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xvfb | Apr 19, 2024 | Apr 5, 2024 |
| Amazon_linux | — | Upgrade tigervncUpgrade xorg-x11-server | Apr 17, 2024 | Apr 5, 2024 |
| Amazon_linux_2023 | — | Upgrade xorg-x11-server-commonUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XdmxUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-debuginfo | Feb 17, 2025 | Apr 3, 2024 |
| Centos_linux | — | Upgrade xorg-x11-server-XdmxUpgrade tigervncUpgrade tigervnc-licenseUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XephyrUpgrade tigervnc-debuginfoUpgrade tigervnc-server-minimalUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-commonUpgrade tigervnc-iconsUpgrade tigervnc-serverUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-appletUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xvfb | Apr 12, 2024 | Apr 5, 2024 |
| Debian | — | Upgrade xwaylandUpgrade xorg-server | Apr 15, 2024 | Apr 5, 2024 |
| Freebsd | — | Upgrade xwaylandUpgrade xwayland-develUpgrade xorg-serverUpgrade xephyrUpgrade xorg-vfbserverUpgrade xorg-nextserver | Dec 10, 2025 | Apr 4, 2024 |
| Gentoo Linux | — | Upgrade x11-base/xorg-server.Upgrade x11-base/xwayland. | Nov 18, 2024 | Apr 5, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade xorg-x11-server-help | Jul 16, 2024 | Apr 5, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade xorg-x11-server-help | Jun 26, 2024 | Apr 5, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade xorg-x11-server-help | Oct 8, 2024 | Apr 5, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade xorg-x11-server-help | Jul 17, 2024 | Apr 5, 2024 |
| Oracle_linux | — | Upgrade tigervnc-selinuxUpgrade xorg-x11-server-XwaylandUpgrade tigervnc-licenseUpgrade tigervncUpgrade tigervnc-server-appletUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-commonUpgrade xorg-x11-server-XdmxUpgrade tigervnc-server-moduleUpgrade tigervnc-serverUpgrade xorg-x11-server-develUpgrade xorg-x11-server-XnestUpgrade tigervnc-server-minimalUpgrade tigervnc-icons | Apr 12, 2024 | Apr 3, 2024 |
| Redhat_linux | — | Upgrade tigervnc-selinuxNo solution existsUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-Xnest-debuginfoUpgrade tigervnc-licenseUpgrade tigervnc-server-module-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-XvfbUpgrade tigervnc-server-debuginfoUpgrade xorg-x11-server-XdmxUpgrade tigervncUpgrade xorg-x11-server-develUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade tigervnc-serverUpgrade xorg-x11-server-XnestUpgrade tigervnc-server-minimalUpgrade tigervnc-server-minimal-debuginfoUpgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-XorgUpgrade xorg-x11-server-debugsourceUpgrade tigervnc-iconsUpgrade xorg-x11-server-debuginfoUpgrade tigervnc-server-appletUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-commonUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-Xephyr-debuginfo | Apr 12, 2024 | Apr 5, 2024 |
| Rocky_linux | — | Upgrade xorg-x11-server-XephyrUpgrade xorg-x11-server-XwaylandUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-Xnest-debuginfoUpgrade xorg-x11-server-Xvfb-debuginfoUpgrade xorg-x11-server-commonUpgrade tigervncUpgrade xorg-x11-server-debuginfoUpgrade xorg-x11-server-XorgUpgrade tigervnc-server-module-debuginfoUpgrade tigervnc-debuginfoUpgrade xorg-x11-server-Xorg-debuginfoUpgrade xorg-x11-server-Xdmx-debuginfoUpgrade xorg-x11-server-Xwayland-develUpgrade xorg-x11-server-XnestUpgrade xorg-x11-server-Xephyr-debuginfoUpgrade tigervnc-server-moduleUpgrade xorg-x11-server-Xwayland-debuginfoUpgrade xorg-x11-server-XdmxUpgrade tigervnc-server-minimalUpgrade tigervnc-server-minimal-debuginfoUpgrade tigervnc-debugsourceUpgrade xorg-x11-server-debugsourceUpgrade xorg-x11-server-Xwayland-debugsourceUpgrade xorg-x11-server-develUpgrade tigervnc-serverUpgrade tigervnc-server-debuginfo | May 8, 2024 | Apr 5, 2024 |
| Suse | — | Upgrade presentproto-develUpgrade wayland-protocols-develUpgrade xwayland-develUpgrade xwaylandUpgrade xorg-x11-server-XvfbUpgrade xorg-x11-server-sourceUpgrade xorg-x11-server-sdkUpgrade dri3proto-develUpgrade xorg-x11-server-waylandUpgrade xorg-x11-serverUpgrade xorg-x11-server-extra | Apr 11, 2024 | Apr 5, 2024 |
| Ubuntu | — | Upgrade xserver-xorg-core (Ubuntu Pro)Upgrade xwayland (Ubuntu Pro)Upgrade xserver-xorg-coreUpgrade xwayland | Apr 5, 2024 | Apr 4, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub