CVE-2024-0229

An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation if the server runs with extended privileges, or...

PT-2024-1121

Name of the Vulnerable Software and Affected Versions X.Org Server affected versions not specified Description A flaw was found in the X.Org server, specifically in the DeviceFocusEvent and XIQueryPointer functions, which can lead to a heap overflow. This issue is caused by the server allocating...

CVE-2024-21885

A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remo...

Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : X.Org X Server vulnerabilities (USN-6587-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6587-1 advisory. Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the DeviceFocusEvent and...

UBUNTU-CVE-2024-0409

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context...

PT-2024-1266 · Unknown +12 · X.Org Server +12

Name of the Vulnerable Software and Affected Versions: X.Org Server versions prior to 21.1.11 Xwayland versions prior to 23.2.4 xorg-server versions prior to 1.20.8-alt12 xorg-server versions prior to 1.20.14-alt11 xorg-xwayland versions prior to 23.1.1-alt4 Description: A heap buffer overflow fl...

xorg server -- Multiple vulnerabilities

The X.Org project reports: CVE-2023-6816: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255 but the X.Org Server was only...

PT-2024-1243

Name of the Vulnerable Software and Affected Versions: X.Org Server versions prior to 21.1.11 Xwayland versions prior to 23.2.4 Description: A flaw was found in the X.Org server, specifically in the cursor code of Xephyr and Xwayland, which uses the wrong type of private at creation. This issue i...

PT-2024-1261 · X.Org +11 · X.Org Server +11

Vulnerability Report Name of the Vulnerable Software and Affected Versions: X.Org Server versions prior to 1.20.14-alt11 X.Org Server versions prior to 2:1.20.11-1+deb11u11 Debian bullseye X.Org Server versions prior to 2:21.1.7-3+deb12u5 Debian bookworm X.Org xwayland versions prior to 23.1.1-al...

PT-2024-1267 · X.Org +11 · X.Org Server +11

Name of the Vulnerable Software and Affected Versions: X.Org Server affected versions not specified Description: An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. The issue...

CVE-2024-0409

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context...

EulerOS Virtualization 2.11.1 : libX11 (EulerOS-SA-2023-3056)

According to the versions of the libX11 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that t...

xorg security update

CentOS Errata and Security Advisory CESA-2024:0009 An update for xorg-x11-server is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

X.Org Server DeepCopyPointerClasses Out-Of-Bounds Access Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Button...

X.Org Server ProcXIChangeProperty Heap-based Buffer Overflow Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the...

X.Org Server RecalculateMasterButtons Out-Of-Bounds Access Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Button...

X.Org Server RRChangeOutputProperty Integer Overflow Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling...

Important: Red Hat Security Advisory: xorg-x11-server security update

An update for xorg-x11-server is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...

Advisory ROSA-SA-2023-2317

Software: libinput 1.16.3 OS: ROSA Virtualization 2.1 packageevrstring: libinput-1.16.3-3.rv3.src.rpm CVE-ID: CVE-2022-1215 BDU-ID: 2022-02695 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the evdevlogmsg function of the libinput library's libinput implementation of the X.Org and Wayland display...

CentOS 7 : tigervnc and xorg-x11-server (RHSA-2023:1594)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:1594 advisory. - A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overl...