Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| xorg-server | fixed | 2:21.1.25-1 | package | |
| xwayland | fixed | 2:24.1.14-1 | package |
Примечания
Xwayland shouldn't be running as root, cf. README.Debian.security
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09 (xorg-server-21.1.25)
Связанные уязвимости
CVSS3: 7.8
redhat
20 дней назад
A flaw was found in the X.Org X Server and XWayland. An error handling issue in the X Keyboard Extension (XKB) geometry processing fails to clear a memory pointer after an allocation failure, leading to a double-free condition during cleanup. A local user can exploit this vulnerability by sending a specially crafted request to the display server. This can cause memory corruption, potentially resulting in a Denial of Service (DoS) or arbitrary code execution with elevated privileges.
