{"id":146775,"date":"2025-10-29T23:12:08","date_gmt":"2025-10-29T21:12:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-20-s-ustraneniem-3-uyazvimostej"},"modified":"2025-10-29T23:12:08","modified_gmt":"2025-10-29T21:12:08","slug":"obnovlenie-x-org-server-21-1-20-s-ustraneniem-3-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-x-org-server-21-1-20-s-ustraneniem-3-uyazvimostej","title":{"rendered":"X.Org Server 21.1.20 Update Fixing 3 Vulnerabilities","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases for X.Org Server 21.1.19 and the DDX component (Device-Dependent X) xwayland 24.1.9 have been published, allowing the X.Org Server to run X11 applications in Wayland-based environments. The new versions fix 3 vulnerabilities rated at 7.8 out of 10 in terms of severity. These issues could potentially be exploited for privilege escalation in systems where the X server runs with root privileges, as well as for remote code execution in configurations utilizing X11 session redirection via SSH. <\/p>\n
Fixed vulnerabilities: <\/p>\n
\n
CVE-2025-62229 \u2014 memory access after it has been freed in the XPresentNotify structure creation code. The issue manifests in the implementation of the X11 Present extension and leads to a pointer to a deleted present_notify object remaining in case of an error during the processing and addition of notifications after rendering the pixel map. The vulnerability has been present since the release of Xorg 1.15 (2013).\n
CVE-2025-62230 \u2014 memory access after it has been freed when removing Xkb resources for a client. The XkbRemoveResourceClient() function freed the memory allocated for XkbInterest data associated with a device but left the resources linked to it. The vulnerability has been present since the release of X11R6 (1994).\n
CVE-2025-62231 \u2014 integer overflow in the Xkb extension. In the XkbCompatMap structure, values were stored as 'unsigned short' types but were not checked to ensure that the input value did not exceed the upper limit of this type. The vulnerability has been present since the release of X11R6 (1994). <\/ul>\n