Most recent entries from all

GHSA-3qj2-mfg9-42jq

A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to leak small amounts of information from X server memory or potentially crash the X server.

OESA-2026-4468 — xorg-x11-server security update

Affected: openEuler:22.03-LTS-SP4: xorg-x11-server

X.Org X11 X server Security Fix(es):

A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges. (From Red Hat.)(CVE-2026-88812)

A flaw was found in xorg-x11-server. A use-after-free vulnerability, where the application accesses memory after it has already been released, occurs in the Present extension because window notification entries are not properly unlinked before cleaning up window resources. An authenticated local X client can exploit this flaw by creating cross-window notifications and subsequently destroying the target window. Successful exploitation primarily results in a Denial of Service (DoS) via an X server crash, and may potentially lead to information disclosure.(CVE-2026-93515)

A flaw was found in xorg-x11-server. A local user can exploit a use-after-free condition—where the software attempts to access memory after it has been freed—by establishing a passive input grab and removing an input device. When subsequent input events are processed, the server dereferences the dangling device pointer. This flaw can lead to arbitrary code e…

openSUSE-SU-2026:12104-1 — xorg-x11-server-21.1.24-2.1 on GA media

xorg-x11-server-21.1.24-2.1 on GA media

SUSE-SU-2026:24230-1 — Security update for xwayland

Security update for xwayland

UBUNTU-CVE-2026-93524

Affected: Ubuntu:Pro:14.04:LTS: xorg-server, Ubuntu:Pro:16.04:LTS: xorg-server, Ubuntu:Pro:16.04:LTS: xorg-server-hwe-16.04, Ubuntu:Pro:18.04:LTS: xorg-server, Ubuntu:Pro:18.04:LTS: xorg-server-hwe-18.04, Ubuntu:Pro:20.04:LTS: xorg-server, Ubuntu:22.04:LTS: xorg-server, Ubuntu:22.04:LTS: xwayland, Ubuntu:24.04:LTS: xorg-server, Ubuntu:24.04:LTS: xwayland and 4 more

[XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read]