Debian Xwayland vulnerabilities

CVE-2023-1393 [HIGH] CVE-2023-1393: xorg-server - A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to lo... A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client explicitly destroys the compositor overlay window (aka COW), the Xserver would leave a dangling pointer to that window in the CompScreen structure, which will trigger a use-after-free later. Scope: local bookworm: resolved (fixed in 2:21.1.7-2) bul

CVE-2022-46341 [HIGH] CVE-2022-46341: xorg-server - A vulnerability was found in X.Org. This security flaw occurs because the handle... A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked with a high keycode or button code. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. Scope: local

CVE-2022-46340 [HIGH] CVE-2022-46340: xorg-server - A vulnerability was found in X.Org. This security flaw occurs becuase the swap h... A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the stack if GenericEvents with lengths larger than 32 bytes are sent through a the XTestFakeInput request. This issue can lead to local privileges elevation on systems where the X server is running privileged a

CVE-2022-46343 [HIGH] CVE-2022-46343: xorg-server - A vulnerability was found in X.Org. This security flaw occurs because the handle... A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwarding sessions. Scope: local bookworm: resolved (fixe

CVE-2022-46344 [HIGH] CVE-2022-46344: xorg-server - A vulnerability was found in X.Org. This security flaw occurs because the handle... A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in out-of-bounds memory reads and potential information disclosure. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X f

CVE-2023-6816 [CRITICAL] CVE-2023-6816: xorg-server - A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer r... A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used. Scope: local boo

CVE-2024-31083 [HIGH] CVE-2024-31083: xorg-server - A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function o... A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently, ProcRenderAddGlyphs() may free a glyph, leading to a use-after-

CVE-2022-3550 [MEDIUM] CVE-2022-3550: xorg-server - A vulnerability classified as critical was found in X.org Server. Affected by th... A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051. Scope: local bookworm: resolved (fixed in 2:21.1.4

CVE-2022-46342 [HIGH] CVE-2022-46342: xorg-server - A vulnerability was found in X.Org. This security flaw occurs because the handle... A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been freed. This issue can lead to local privileges elevation on systems where the X se Scope: local bookworm: resolved (fixed in 2:21.1.5-1) bullseye: resolved (fixed in 2:1.20.11-1+deb11u4) forky: resolved (fi

CVE-2023-6377 [HIGH] CVE-2023-6377: xorg-server - A flaw was found in xorg-server. Querying or changing XKB button actions such as... A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved. Scope: local bookworm: resolved (fixed in 2:21.1.7-3+deb12u4) bullseye: resolve

CVE-2024-0229 [HIGH] CVE-2024-0229: xorg-server - An out-of-bounds memory access flaw was found in the X.Org server. This issue ca... An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments. Scope: loca

CVE-2024-21885 [HIGH] CVE-2024-21885: xorg-server - A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it... A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remote code execution in SSH X11 forwarding environments. Scope: local

CVE-2024-21886 [HIGH] CVE-2024-21886: xorg-server - A heap buffer overflow flaw was found in the DisableDevice function in the X.Org... A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments. Scope: local bookworm: resolved (fixed in 2:21.1.7-3+deb12u5) bullseye: resolved (fixed in 2:1.20.11-1+deb11u11) forky: resolved (fixed in 2:21.1.

CVE-2022-2320 [HIGH] CVE-2022-2320: xorg-server - A flaw was found in the Xorg-x11-server. The specific flaw exists within the han... A flaw was found in the Xorg-x11-server. The specific flaw exists within the handling of ProcXkbSetDeviceInfo requests. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. This flaw allows an attacker to escalate privileges and execute arbitrary code in the context of

CVE-2023-6478 [HIGH] CVE-2023-6478: xorg-server - A flaw was found in xorg-server. A specially crafted request to RRChangeProvider... A flaw was found in xorg-server. A specially crafted request to RRChangeProviderProperty or RRChangeOutputProperty can trigger an integer overflow which may lead to a disclosure of sensitive information. Scope: local bookworm: resolved (fixed in 2:21.1.7-3+deb12u3) bullseye: resolved (fixed in 2:1.20.11-1+deb11u9) forky: resolved (fixed in 2:21.1.10-1) sid: resolv

CVE-2025-26595 [HIGH] CVE-2025-26595: xorg-server - A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskT... A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size. Scope: local bookworm: resolved (fixed in 2:21.1.7-3+deb12u9) bullseye: res

CVE-2025-26598 [HIGH] CVE-2025-26598: xorg-server - An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBar... An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.

CVE-2025-49180 [HIGH] CVE-2025-49180: xorg-server - A flaw was found in the RandR extension, where the RRChangeProviderProperty func... A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate. Scope: local bookworm: resolved (fixed in 2:21.1.7-3+deb12u10) bullseye: resolved (fixed in 2:1.20.11-1+deb11u16) forky: resolved (fixed in 2:21.1.16-1.2) sid: re

CVE-2025-62231 [HIGH] CVE-2025-62231: xorg-server - A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where i... A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflow, leading to memory corruption or a crash. Scope: local bookworm: resolved (fixed in 2:21.1.7-3+deb12u1

CVE-2022-4283 [HIGH] CVE-2022-4283: xorg-server - A vulnerability was found in X.Org. This security flaw occurs because the XkbCop... A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bounds memory access on subsequent XkbGetKbdByName requests.. This issue can lead to local privileges elevation on systems where the X server is running privileged and remote code execution for ssh X forwardin