{"id":168785,"date":"2026-04-15T11:12:00","date_gmt":"2026-04-15T09:12:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-22-s-ustraneniem-5-uyazvimostej"},"modified":"2026-04-15T11:12:00","modified_gmt":"2026-04-15T09:12:00","slug":"obnovlenie-x-org-server-21-1-22-s-ustraneniem-5-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/obnovlenie-x-org-server-21-1-22-s-ustraneniem-5-uyazvimostej","title":{"rendered":"Update X.Org Server 21.1.22 addressing 5 vulnerabilities.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective releases of X.Org Server 21.1.22 and the DDX component (Device-Dependent X) xwayland 24.1.10 have been published, enabling the launch of X.Org Server to facilitate the execution of X11 applications in Wayland-based environments. The new versions address five vulnerabilities. Some vulnerabilities could potentially be exploited to escalate privileges in systems where the X server runs with root permissions, as well as for remote code execution in configurations that use X11 session redirection via SSH. <\/p>\n
Fixed vulnerabilities: <\/p>\n
\n
CVE-2026-34001 \u2014 use-after-free memory access in the function miSyncTriggerFence(). The vulnerability was introduced with the release of xorg-server 1.9.0 (2010).\n
CVE-2026-33999 \u2014 integer underflow in the function XkbSetCompatMap(), leading to reading data from outside the buffer when processing specially crafted requests. The vulnerability was introduced with the release of X11R6.6 (2001).\n
CVE-2026-34000 \u2014 buffer over-read in the function XkbAddGeomKeyAlias caused by the lack of size verification of the passed key name against the allocated buffer. The vulnerability appeared with the releases of xorg-server 21.1.4 and xwayland 22.1.3 (2022).\n
CVE-2026-34002 \u2014 buffer over-read in the function CheckModifierMap() due to the lack of verification of the number of specified keys in the request against the actual number of provided parameters. The vulnerability was introduced with the release of X11R6.6 (2001).\n
CVE-2026-34003 \u2014 buffer overflow in the XKB function CheckKeyTypes(), leading to reading data from outside the buffer due to the lack of buffer size verification for the data provided in the request. The vulnerability was introduced with the release of X11R6.6 (2001). <\/ul>\n