Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| xorg-server | fixed | 2:21.1.25-1 | package | |
| xwayland | fixed | 2:24.1.14-1 | package |
Примечания
Xwayland shouldn't be running as root, cf. README.Debian.security
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5ec0535af2bcc93381666dc110abebba8975f8ae (xorg-server-21.1.25)
Связанные уязвимости
CVSS3: 7.8
redhat
20 дней назад
A flaw was found in xorg-x11-server. In the X Keyboard Extension (XKB), key name memory is allocated with an insufficient buffer size compared to the maximum supported range. An authenticated local client can exploit this flaw by sending requests that modify the keycode range, triggering a heap-based buffer overflow. This vulnerability can lead to arbitrary code execution or cause a Denial of Service (DoS) by crashing the X server.
