{"id":122099,"date":"2025-02-26T14:22:10","date_gmt":"2025-02-26T12:22:10","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-16-s-ustraneniem-8-uyazvimostej"},"modified":"2025-02-26T14:22:10","modified_gmt":"2025-02-26T12:22:10","slug":"obnovlenie-x-org-server-21-1-16-s-ustraneniem-8-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-16-s-ustraneniem-8-uyazvimostej","title":{"rendered":"Aggiornamento di X.Org Server 21.1.16 che risolve 8 vulnerabilit\u00e0.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Sono stati pubblicati gli aggiornamenti correttivi X.Org Server 21.1.16 e il componente DDX (Device-Dependent X) xwayland 24.1.6, che garantisce l'avvio di X.Org Server per il funzionamento di applicazioni X11 in ambienti basati su Wayland. Nella nuova versione di X.Org Server sono state risolte 8 vulnerabilit\u00e0. I problemi potrebbero essere sfruttati per l'elevazione dei privilegi nei sistemi in cui il server X \u00e8 eseguito con diritti di root, e anche per l'esecuzione remota di codice nelle configurazioni in cui l'accesso avviene tramite il reindirizzamento della sessione X11 tramite SSH. <\/p>\n
Vulnerabilit\u00e0 identificate: <\/p>\n
\n
CVE-2025-26594 \u2014 access to already freed memory (Use-after-free) in the root window cursor handler. The vulnerability has been present since the time of the X11R6.6 release in 2001.\n
CVE-2025-26595 \u2014 buffer overflow in the XkbVModMaskText() function caused by copying virtual modifier names into a fixed buffer without adequate size checking. The vulnerability has been present since X11R6.1 (1996).\n
CVE-2025-26596 \u2014 buffer overflow in the XkbWriteKeySyms() function related to the mismatch between the size calculated by the XkbSizeKeySyms() function and the size of data written by XkbWriteKeySyms(). The vulnerability has been present since the first version of xkb.c included in X11R6 (1994).\n
CVE-2025-26597 \u2014 buffer overflow in the XkbChangeTypesOfKey() function due to the use of an incorrect size of the character code table. The vulnerability has been present since the release of X11R6.1 (1996).\n
CVE-2025-26598 \u2014 access to data outside the buffer in the CreatePointerBarrierClient() function, caused by returning an incorrect index in the list when a pointer device search fails. The vulnerability has been present since xorg-server 1.14.0 (2013).\n
CVE-2025-26599 \u2014 access through an uninitialized pointer in the compRedirectWindow() function when unable to allocate memory for the bitmap. The vulnerability has been present since Xorg 6.8.0 (2004).\n
CVE-2025-26600 \u2014 access to already freed memory in the PlayReleasedEvents() function when retrieving a hung device with remaining unhandled events. The vulnerability has been present since X11R5 (1991).\n
CVE-2025-26601 \u2014 access to already freed memory in the SyncInitTrigger() function. The vulnerability has been present since X11R6 (1994). <\/ul>\n