{"id":114795,"date":"2024-04-05T00:25:42","date_gmt":"2024-04-04T22:25:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-12-s-ustraneniem-4-uyazvimostej"},"modified":"2024-04-05T00:25:42","modified_gmt":"2024-04-04T22:25:42","slug":"obnovlenie-x-org-server-21-1-12-s-ustraneniem-4-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-x-org-server-21-1-12-s-ustraneniem-4-uyazvimostej","title":{"rendered":"X.Org Server 21.1.12 Update Addressing 4 Vulnerabilities","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The corrective releases of X.Org Server 21.1.12 and the DDX component (Device-Dependent X) xwayland 23.2.5 have been published, enabling the launch of X.Org Server for running X11 applications in Wayland-based environments. The new version of X.Org Server addresses 4 vulnerabilities. One vulnerability can be exploited to escalate privileges in systems where the X server runs with root privileges, as well as for remote code execution in configurations where session redirection for X11 is accessed using SSH. <\/p>\n

The other three vulnerabilities could lead to memory content leakage server<\/a> or to crashes. These three vulnerabilities are exploited through the use of a different byte order on the client-side than on the server<\/a>As a result, the new release offers the ability to block client connections from systems with a different byte order. You can use the configuration parameter 'AllowByteSwappedClients' or the command line option '+byteswappedclients' to disable it. <\/p>\n

Changing the default value provides protection against potentially undiscovered vulnerabilities that manipulate byte order. The essence of such vulnerabilities is that changing the byte order for data of a certain size can lead to their incorrect interpretation and reading or writing into memory with a size exceeding the allocated buffer. <\/p>\n

By default, support for clients with a different byte order is still maintained, despite the fact that, in practice, byte order conversion has recently been used exceedingly rarely, as workstations running the X server are typically equipped with little-endian (from least significant to most significant byte) processors, and connecting to them X clients with a big-endian order, such as the s390x platform (IBM zSystems), is quite rare. <\/p>\n

Identified issues: <\/p>\n