Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| xorg-server | fixed | 2:21.1.25-1 | package | |
| xwayland | fixed | 2:24.1.14-1 | package |
Примечания
Xwayland shouldn't be running as root, cf. README.Debian.security
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/aa56160fa213d8767e7da0c076b5c8242703313b (xorg-server-21.1.25)
Связанные уязвимости
CVSS3: 7.8
redhat
20 дней назад
A flaw was found in xorg-x11-server. A local authenticated client can exploit this flaw by sending a crafted input device ungrab request with an unvalidated modifier value. This lack of validation causes the server to perform an out-of-bounds write on the heap, resulting in memory corruption that can lead to a denial of service (DoS) or potential arbitrary code execution.
