Описание
Security update for xorg-x11-server
This update for xorg-x11-server fixes the following issues:
- CVE-2026-33999: XKB integer underflow in XkbSetCompatMap() (bsc#1260922).
- CVE-2026-34000: XKB out-of-bounds read in CheckSetGeom() (bsc#1260923).
- CVE-2026-34001: XSYNC use-after-free in miSyncTriggerFence() (bsc#1260924).
- CVE-2026-34002: XKB out-of-bounds read in CheckModifierMap() (bsc#1260925).
- CVE-2026-34003: XKB buffer overflow in CheckKeyTypes() (bsc#1260926).
Список пакетов
Image SLES15-SP6-SAP
Image SLES15-SP6-SAP-Azure
Image SLES15-SP6-SAP-EC2
Image SLES15-SP6-SAP-GCE
Image SLES15-SP6-SAPCAL
Image SLES15-SP6-SAPCAL-Azure
Image SLES15-SP6-SAPCAL-EC2
Image SLES15-SP6-SAPCAL-GCE
SUSE Linux Enterprise Server 15 SP6-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP6
openSUSE Leap 15.6
Ссылки
- Link for SUSE-SU-2026:1331-1
- E-Mail link for SUSE-SU-2026:1331-1
- SUSE Security Ratings
- SUSE Bug 1260922
- SUSE Bug 1260923
- SUSE Bug 1260924
- SUSE Bug 1260925
- SUSE Bug 1260926
- SUSE CVE CVE-2026-33999 page
- SUSE CVE CVE-2026-34000 page
- SUSE CVE CVE-2026-34001 page
- SUSE CVE CVE-2026-34002 page
- SUSE CVE CVE-2026-34003 page
Описание
A flaw was found in the X.Org X server. This integer underflow vulnerability, specifically in the XKB compatibility map handling, allows an attacker with local or remote X11 server access to trigger a buffer read overrun. This can lead to memory-safety violations and potentially a denial of service (DoS) or other severe impacts.
Затронутые продукты
Ссылки
- CVE-2026-33999
- SUSE Bug 1260922
Описание
A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.
Затронутые продукты
Ссылки
- CVE-2026-34000
- SUSE Bug 1260923
Описание
A flaw was found in the X.Org X server. This use-after-free vulnerability occurs in the XSYNC fence triggering logic, specifically within the miSyncTriggerFence() function. An attacker with access to the X11 server can exploit this without user interaction, leading to a server crash and potentially enabling memory corruption. This could result in a denial of service or further compromise of the system.
Затронутые продукты
Ссылки
- CVE-2026-34001
- SUSE Bug 1260924
- SUSE Bug 1265555
Описание
A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.
Затронутые продукты
Ссылки
- CVE-2026-34002
- SUSE Bug 1260925
Описание
A flaw was found in the X.Org X server's XKB key types request validation. A local attacker could send a specially crafted request to the X server, leading to an out-of-bounds memory access vulnerability. This could result in the disclosure of sensitive information or cause the server to crash, leading to a Denial of Service (DoS). In certain configurations, higher impact outcomes may be possible.
Затронутые продукты
Ссылки
- CVE-2026-34003
- SUSE Bug 1260926