{"id":146775,"date":"2025-10-29T23:12:08","date_gmt":"2025-10-29T21:12:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-20-s-ustraneniem-3-uyazvimostej"},"modified":"2025-10-29T23:12:08","modified_gmt":"2025-10-29T21:12:08","slug":"obnovlenie-x-org-server-21-1-20-s-ustraneniem-3-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/obnovlenie-x-org-server-21-1-20-s-ustraneniem-3-uyazvimostej","title":{"rendered":"Aggiornamento X.Org Server 21.1.20 con la correzione di 3 vulnerabilit\u00e0","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Pubblicati gli aggiornamenti correttivi X.Org Server 21.1.19 e il componente DDX (Device-Dependent X) xwayland 24.1.9, che consente l'avvio di X.Org Server per gestire l'esecuzione delle applicazioni X11 in ambienti basati su Wayland. Nelle nuove versioni sono state risolte 3 vulnerabilit\u00e0, a cui \u00e8 stato assegnato un livello di gravit\u00e0 di 7.8 su 10. I problemi potrebbero essere sfruttati per aumentare i privilegi nei sistemi in cui il server X viene eseguito con diritti di root, nonch\u00e9 per l'esecuzione remota di codice in configurazioni in cui l'accesso avviene tramite il reindirizzamento della sessione X11 tramite SSH. <\/p>\n
Vulnerabilit\u00e0 corrette: <\/p>\n
\n
CVE-2025-62229 \u2014 access to memory after it has been freed in the XPresentNotify structure creation code. The issue manifests in the implementation of the X11 Present extension and leads to leaving a pointer to a deleted present_notify object in case of an error during the processing and addition of notifications after displaying the pixel map. The vulnerability has been present since the release of Xorg 1.15 (2013).\n
CVE-2025-62230 \u2014 access to memory after it has been freed when deleting Xkb resources for a client. The function XkbRemoveResourceClient() freed the memory allocated for XkbInterest data associated with the device, but left the resources linked to it. The vulnerability has been present since the release of X11R6 (1994).\n
CVE-2025-62231 \u2014 integer overflow in the Xkb extension. In the XkbCompatMap structure, values were stored with the type 'unsigned short', but there was no check that the input value could exceed the upper limit of this type. The vulnerability has been present since the release of X11R6 (1994). <\/ul>\n