AlmaLinux 9.2 [TuxCare] Security Update: xorg-x11-server-Xwayland / xorg-x11-server-Xwayland-devel Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1763558418)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1763558418 advisory. - A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in...

Astra Linux – Vulnerability in xorg-server

A vulnerability was discovered in X.Org. This security flaw arises because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges escalation on systems where the X server is running with privileged access, and may...

Astra Linux – Vulnerability in xorg-server

A use-after-free flaw was discovered in the X.Org X server and Xwayland in the CreateSaverWindow function. A client can trigger a use-after-free error after changing window attributes and forcing the screen saver, resulting in information disclosure...

Astra Linux – Vulnerability in xorg-server

A flaw was discovered in the X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can lead to a heap buffer overflow condition, which may result in an application...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the handling of animated cursors by the X Rendering extension. If a client does not provide any cursors, the server assumes that at least one is present. This can lead to an out-of-bounds read and potential crash...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the Big Requests extension. The length of the request is multiplied by 4 before checking against the maximum allowed size, which may lead to an integer overflow and bypassing the size check...

Astra Linux – Vulnerability in xorg-server

A stack-based buffer overflow vulnerability was discovered in the X.Org X server and Xwayland. A mismatch between the X server’s requirements and the maximum font name length supported by the libXfont2 library can lead to a stack buffer overflow during font alias resolution. The X server allocate...

Astra Linux – Vulnerability in xorg-server, xwayland

A heap overflow flaw was discovered in X.Org and Xwayland. The calculation of the length in XkbSizeKeySyms differs from what is stored in XkbWriteKeySyms, which may lead to a heap-based buffer overflow...

Astra Linux – Vulnerability in xorg-server, xwayland

A buffer overflow vulnerability was discovered in X.Org and Xwayland. The code in XkbVModMaskText allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and will copy the data regardless of the siz...

Astra Linux – Vulnerability in xorg-server

A out-of-bounds write flaw was discovered in the X.Org X server and Xwayland within DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger a out-of-bounds heap write. This vulnerability could be exploited to...

Astra Linux – Vulnerability in xorg-server

A use-after-free vulnerability was discovered in the ProcRenderAddGlyphs function of Xorg servers. This issue arises when the AllocateGlyph function is called to store new glyphs sent by the client to the X server. As a result, multiple entries may point to the same non-refcounted glyphs...

Astra Linux – Vulnerability in xorg-server

A use-after-free flaw was discovered in the X.Org X server and Xwayland within the FreeCounter function. A client that sets up multiple SyncCounters and waits for those triggers can trigger a use-after-free when destroying those counters through a second client connection. This could potentially...

Astra Linux – Vulnerability in xorg-server

A out-of-bounds read flaw was discovered in the X.Org X server and Xwayland within the glXDispChangeDrawableAttributes function. A incorrect size validation check allows a client-controlled number of bytes to be read, exceeding the request buffer, resulting in information disclosure. A write path...

Astra Linux – Vulnerability in xorg-server

A flaw was discovered in xorg-x11-server in versions prior to 21.1.2 and prior to 1.20.14. An out-of-bounds access can occur in the SwapCreateRegister function. The greatest threat posed by this vulnerability is related to data confidentiality and integrity, as well as system availability...

Astra Linux – Vulnerability in xorg-server

A flaw was discovered in the Xorg-x11-server. A out-of-bounds access issue may occur in the ProcXkbSetGeometry function due to improper validation of the request length...

Astra Linux – Vulnerability in xorg-server

A vulnerability, which was classified as problematic, has been identified in the X.org Server. The affected component is the function ProcXkbGetKbdByName in the file xkb/xkb.c. This vulnerability causes a memory leak. It is recommended that a patch be applied to address this issue. The identifier...

Astra Linux – Vulnerability in xorg-server

A flaw was discovered in xorg-server. Changing the actions of XKB buttons, such as moving between the touchpad and the mouse, can lead to out-of-bounds memory reads and writes. This may allow for local privilege escalation or potential remote code execution, especially in cases where X11 forwardi...

Astra Linux – Vulnerability in xorg-server

A flaw was discovered in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow, which may lead to the disclosure of sensitive information...

Astra Linux – Vulnerability in xorg-server

A flaw related to out-of-bounds memory access was discovered in the X.Org server. This issue can occur when a device that has been frozen by a sync operation is reattached to a different master device. This issue may result in an application crashing, local privilege escalation if the server runs...

Astra Linux – Vulnerability in xorg-server, xwayland

A heap-based buffer overflow vulnerability was discovered in the X.org server’s ProcXIPassiveGrabDevice function. This issue occurs when length values that are swapped in bytes are used in responses, potentially leading to memory leakage and segmentation faults, especially when triggered by a...