Astra Linux – Vulnerability in xorg-server

A flaw was discovered in the X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can lead to a heap buffer overflow condition, which may result in an application...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the Big Requests extension. The length of the request is multiplied by 4 before checking against the maximum allowed size, which may lead to an integer overflow and bypassing the size check...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X server’s request handling. A non-zero value for “bytes to ignore” in a client’s request can cause the server to skip processing another client’s request, potentially leading to a denial of service...

Astra Linux – Vulnerability in xwayland, xorg-server

A buffer overflow vulnerability was discovered in X.Org and Xwayland. If the XkbChangeTypesOfKey function is called with a value of 0 for the “groups” parameter, it will resize the key symbol table to 0, but leave the key actions unchanged. If the same function is called later with a non-zero val...

Astra Linux – Vulnerability in xorg-server

A use-after-free flaw was discovered in the X.Org X server and Xwayland in the CreateSaverWindow function. A client can trigger a use-after-free error after changing window attributes and forcing the screen saver, resulting in information disclosure...

Astra Linux – Vulnerability in xorg-server

A out-of-bounds read flaw was discovered in the X.Org X server and Xwayland within the glXDispChangeDrawableAttributes function. A incorrect size validation check allows a client-controlled number of bytes to be read, exceeding the request buffer, resulting in information disclosure. A write path...

Astra Linux – Vulnerability in xorg-server

A vulnerability was discovered in X.Org. This security flaw arises because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges escalation on systems where the X server is running with privileged access, and may...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the handling of animated cursors by the X Rendering extension. If a client does not provide any cursors, the server assumes that at least one is present. This can lead to an out-of-bounds read and potential crash...

Astra Linux – Vulnerability in xwayland, xorg-server

A heap overflow flaw was discovered in X.Org and Xwayland. The calculation of the length in XkbSizeKeySyms differs from what is stored in XkbWriteKeySyms, which may lead to a heap-based buffer overflow...

Astra Linux – Vulnerability in xorg-server

A stack-based buffer overflow vulnerability was discovered in the X.Org X server and Xwayland. A mismatch between the X server’s requirements and the maximum font name length supported by the libXfont2 library can lead to a stack buffer overflow during font alias resolution. The X server allocate...

Astra Linux – Vulnerability in xorg-server

A vulnerability was discovered in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local privileges escalation on systems where X is used...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests...

Astra Linux – Vulnerability in xorg-server

A use-after-free vulnerability was discovered in the ProcRenderAddGlyphs function of Xorg servers. This issue arises when the AllocateGlyph function is called to store new glyphs sent by the client to the X server. As a result, multiple entries may point to the same non-refcounted glyphs...

Astra Linux – Vulnerability in xorg-server

In the X.Org X Server versions 20.11 through 21.1.16, when a client application uses easystroke for mouse gestures, the main thread modifies various data structures used by the input thread without acquiring a lock, which is known as a race condition. Specifically, the AttachDevice function in...

Astra Linux – Vulnerability in xwayland, xorg-server

A flaw was discovered in the X.Org X server’s validation of XKB key type requests. A local attacker could send a specially crafted request to the X server, leading to a vulnerability where out-of-bounds memory access could occur. This could result in the disclosure of sensitive information or cau...

Astra Linux – Vulnerability in xwayland, xorg-server

A buffer overflow vulnerability was discovered in X.Org and Xwayland. The code in XkbVModMaskText allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and will copy the data regardless of the siz...

Astra Linux – Vulnerability in xorg-server

A out-of-bounds write flaw was discovered in the X.Org X server and Xwayland within DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger a out-of-bounds heap write. This vulnerability could be exploited to...

Astra Linux – Vulnerability in xorg-server

A stack-based buffer overflow vulnerability was discovered in the X.Org X server and Xwayland. The XkbSetMapChecks function declares a fixed-size stack buffer, mapWidths256, indexed by key type index. The helper function CheckKeyTypes writes to this buffer at a position controlled by the client,...

[SECURITY] [DSA 6497-1] xorg-server security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6497-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 12, 2026 https://www.debian.org/security/faq -...

Debian dsa-6497 : xnest - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6497 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6497-1 [email protected] https://www.debian.org/securit...