Corrective releases of X.Org Server 21.1.23 and the DDX component (Device-Dependent X) xwayland 24.1.12 have been published, allowing the X.Org Server to run X11 applications in Wayland-based environments. The new versions fix 9 vulnerabilities. Some vulnerabilities could potentially be exploited to escalate privileges in systems where the X server runs with root privileges, as well as for remote code execution in configurations where session redirection via SSH is used for access.
Fixed vulnerabilities (CVE identifiers not assigned):
- Buffer overflow when processing alternative font names. The issue is caused by differing size limitations for font names in the libXfont2 library and the X server— server allocated 256 bytes for the name, while the library allowed names up to 1024 bytes.
- Use-after-free accesses in functions miSyncDestroyFence(), FreeCounter(), and SyncChangeCounter() due to errors in reference counting.
- Buffer overflow when processing certain key types in XKB. The issue arises from incorrect calculation of the size of the symbol code table.
- Buffer overflow in XKB occurring while processing SetMap requests due to lack of proper size checks on the data sent by the client.
- Reading and writing data beyond buffer boundaries in GLX due to improper size checks on attributes received from the user in the ChangeDrawableAttributes function.
- Use-after-free access occurring after changing window attributes and forcefully invoking the screensaver. This issue may lead to data leakage from the process’s memory.
- Out-of-bounds write in DRI2 functions DRIGetBuffers and DRIGetBuffersWithFormat, occurring when requesting multiple instances of DRI2BufferBackLeft, but a single instance of DRI2BufferFrontLeft.
Source: opennet.ru
