{"id":146775,"date":"2025-10-29T23:12:08","date_gmt":"2025-10-29T21:12:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-20-s-ustraneniem-3-uyazvimostej"},"modified":"2025-10-29T23:12:08","modified_gmt":"2025-10-29T21:12:08","slug":"obnovlenie-x-org-server-21-1-20-s-ustraneniem-3-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-20-s-ustraneniem-3-uyazvimostej","title":{"rendered":"Aggiornamento di X.Org Server 21.1.20 con la risoluzione di 3 vulnerabilit\u00e0.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Sono stati pubblicati aggiornamenti correttivi per X.Org Server 21.1.19 e il componente DDX (Device-Dependent X) xwayland 24.1.9, che permette l'esecuzione di X.Org Server per gestire applicazioni X11 in ambienti basati su Wayland. Nelle nuove versioni sono state risolte 3 vulnerabilit\u00e0, a cui \u00e8 stato attribuito un livello di rischio di 7.8 su 10. Questi problemi potrebbero potenzialmente essere sfruttati per acquisire privilegi nei sistemi in cui il server X viene eseguito con diritti root, oltre che per l'esecuzione remota di codice in configurazioni in cui l'accesso avviene tramite il reindirizzamento della sessione X11 tramite SSH. <\/p>\n
Vulnerabilit\u00e0 corrette: <\/p>\n
\n
CVE-2025-62229 \u2014 access to memory after it has been freed in the XPresentNotify structure creation code. The issue arises in the implementation of the X11 Present extension and leads to a pointer to a deleted present_notify object remaining in case of an error during the processing and addition of notifications after displaying the pixmap. The vulnerability has been present since the release of Xorg 1.15 (2013).\n
CVE-2025-62230 \u2014 access to memory after it has been freed when deleting Xkb resources for a client. The XkbRemoveResourceClient() function freed memory allocated for XkbInterest data associated with a device but left the resources linked to it. The vulnerability has been present since the release of X11R6 (1994).\n
CVE-2025-62231 \u2014 integer overflow in the Xkb extension. In the XkbCompatMap structure, values were stored as 'unsigned short' type but were not checked to ensure that the input value does not exceed the upper limit of this type. The vulnerability has been present since the release of X11R6 (1994). <\/ul>\n