CVE-2023-0494

A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.

• CWE-416
• CWE-416

• https://bugzilla.redhat.com/show_bug.cgi?id=2165995Issue Tracking, Third Party Advisory
• https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ecPatch
• https://lists.x.org/archives/xorg-announce/2023-February/003320.htmlMailing List, Vendor Advisory
• https://security.gentoo.org/glsa/202305-30
• https://bugzilla.redhat.com/show_bug.cgi?id=2165995Issue Tracking, Third Party Advisory
• https://gitlab.freedesktop.org/xorg/xserver/-/commit/0ba6d8c37071131a49790243cdac55392ecf71ecPatch
• https://lists.x.org/archives/xorg-announce/2023-February/003320.htmlMailing List, Vendor Advisory
• https://security.gentoo.org/glsa/202305-30

Published

Mar 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-0488Cross-site Scripting (XSS) - Stored in GitHub repository pyl…5.4
• CVE-2023-0489The SlideOnline WordPress plugin through 1.2.1 does not vali…5.4
• CVE-2023-0490The f(x) TOC WordPress plugin through 1.1.0 does not validat…5.4
• CVE-2023-0491The Schedulicity WordPress plugin through 2.21 does not vali…5.4
• CVE-2023-0492The GS Products Slider for WooCommerce WordPress plugin befo…5.4
• CVE-2023-0493Improper Neutralization of Equivalent Special Elements in Gi…8.8
• CVE-2023-0495The HT Slider For Elementor WordPress plugin before 1.4.0 do…4.3
• CVE-2023-0496The HT Event WordPress plugin before 1.4.6 does not have CSR…4.3
• CVE-2023-0497The HT Portfolio WordPress plugin before 1.1.6 does not have…4.3
• CVE-2023-0498The WP Education WordPress plugin before 1.2.7 does not have…4.3
• CVE-2023-0499The QuickSwish WordPress plugin before 1.1.0 does not have C…4.3
• CVE-2023-0500The WP Film Studio WordPress plugin before 1.3.5 does not ha…6.5