{"id":111085,"date":"2023-10-25T09:10:21","date_gmt":"2023-10-25T07:10:21","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-9-i-xwayland-23-2-2-s-ustraneniem-uyazvimostej"},"modified":"2023-10-25T09:10:21","modified_gmt":"2023-10-25T07:10:21","slug":"obnovlenie-x-org-server-21-1-9-i-xwayland-23-2-2-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-x-org-server-21-1-9-i-xwayland-23-2-2-s-ustraneniem-uyazvimostej","title":{"rendered":"Opdatering af X.Org Server 21.1.9 og xwayland 23.2.2 med rettelser til s\u00e5rbarheder","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Korrigerende udgivelser af X.Org Server 21.1.9 og DDX-komponenten (Device-Dependent X) xwayland 22.2.2 er offentliggjort, hvilket muligg\u00f8r lanceringen af X.Org Server for at k\u00f8re X11-applikationer i Wayland-baserede milj\u00f8er. I de nye versioner er der rettet s\u00e5rbarheder, der potentielt kan udnyttes til at opn\u00e5 forh\u00f8jede rettigheder i systemer, hvor X-serveren k\u00f8rer med root-rettigheder, samt til fjernudf\u00f8relse af kode i konfigurationer, hvor adgang benytter X11-sessionsdirigering via SSH.       <\/p>\n<p>Identificerede problemer:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2023-5367 \u2014 buffer overflow in the functions XIChangeDeviceProperty and RRChangeOutputProperty, which can be exploited by attaching additional elements to the input device property or the randr property. The vulnerability is present starting from the xorg-server release 1.4.0 (2007) and is due to incorrect offset calculation when attaching additional elements to existing properties, causing elements to be added with an incorrect offset, leading to writing to memory beyond the allocated buffer. For example, when attaching 3 elements to 5 existing elements, memory will be allocated for an array of 8 elements, but the previously existing elements will be kept in the new array starting from index 5, not 3, which will result in the last two elements being written out of bounds.\n<li class=\"l\"> CVE-2023-5380 \u2014 use-after-free memory access in the DestroyWindow function. The issue can be exploited by moving the pointer between screens in multi-monitor configurations in zaphod mode, where a separate screen is created for each monitor, and invoking the client window closing function. The vulnerability is present starting from the xorg-server release 1.7.0 (2009) and is caused by the fact that after closing a window and freeing the associated memory, an active pointer to the previous window remains in the structure that provides screen binding. Xwayland is not affected by the vulnerability in question.\n<li class=\"l\"> CVE-2023-5574 \u2014 use-after-free memory access in the DamageDestroy function. The vulnerability can be exploited in <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/dts-newyork\/\"   title=\"serveren\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2753\">serveren<\/a> Xvfb i f\u00e6rd med at rydde strukturen   ScreenRec under serverens afslutning eller frakoblingen af den sidste klient. Som i den tidligere s\u00e5rbarhed optr\u00e6der problemet kun i mult.monitor-konfigurationer i Zaphod-tilstand. S\u00e5rbarheden er til stede fra udgivelsen af xorg-server-1.13.0 (2012) og er fortsat uretteret (rettelse kun som patch).  <\/ul>\n<p>Udover at rette s\u00e5rbarheder i xwayland 23.2.2 er der ogs\u00e5 sket en overgang fra libbsd-overlay biblioteket til libbsd, og den automatiske forbindelse til RemoteDesktop XDG Desktop Portal for at bestemme socketen, der bruges til at sende til komposit er blevet stoppet. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/server\/dts-shicago\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2929\">server<\/a> XTest events. Automatic connection created problems when launching Xwayland in a nested composite server, so in the new version, you must explicitly specify the option \u2018-enable-ei-portal\u2019 to connect to the portal.<br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=59991\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.9 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 22.2.2, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435 Wayland. \u0412 \u043d\u043e\u0432\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u044b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 X-\u0441\u0435\u0440\u0432\u0435\u0440 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 root, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f\u0445, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111085","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.9 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 22.2.2, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-x-org-server-21-1-9-i-xwayland-23-2-2-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 X.Org Server 21.1.9 \u0438 xwayland 23.2.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.9 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 22.2.2, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-x-org-server-21-1-9-i-xwayland-23-2-2-s-ustraneniem-uyazvimostej\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-10-25T07:10:21+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-10-25T07:10:21+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Opdatering af X.Org Server 21.1.9 og xwayland 23.2.2 med udbedring af s\u00e5rbarheder | ProHoster","description":"Korrigerende udgivelser til X.Org Server 21.1.9 og DDX-komponenten (Device-Dependent X) xwayland 22.2.2 er offentliggjort, hvilket muligg\u00f8r drift af X.Org Server for at k\u00f8re X11-applikationer i milj\u00f8er baseret p\u00e5.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-x-org-server-21-1-9-i-xwayland-23-2-2-s-ustraneniem-uyazvimostej","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 X.Org Server 21.1.9 \u0438 xwayland 23.2.2 \u0441 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0432\u044b\u043f\u0443\u0441\u043a\u0438 X.Org Server 21.1.9 \u0438 DDX-\u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 (Device-Dependent X) xwayland 22.2.2, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e \u0437\u0430\u043f\u0443\u0441\u043a X.Org Server \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f X11-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f\u0445 \u043d\u0430 \u0431\u0430\u0437\u0435.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/obnovlenie-x-org-server-21-1-9-i-xwayland-23-2-2-s-ustraneniem-uyazvimostej","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-10-25T07:10:21+00:00","article:modified_time":"2023-10-25T07:10:21+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111085","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:40:01","updated":"2026-02-09 21:42:05","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111085","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=111085"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111085\/revisions"}],"predecessor-version":[{"id":160209,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/111085\/revisions\/160209"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=111085"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=111085"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=111085"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}