{"id":182538,"date":"2026-07-08T10:54:06","date_gmt":"2026-07-08T08:54:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-x-org-server-21-1-24-xwayland-24-1-13-i-libxfont2-2-0-8-s-ustraneniem-uyazvimostej"},"modified":"2026-07-08T10:54:06","modified_gmt":"2026-07-08T08:54:06","slug":"obnovlenie-x-org-server-21-1-24-xwayland-24-1-13-i-libxfont2-2-0-8-s-ustraneniem-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/obnovlenie-x-org-server-21-1-24-xwayland-24-1-13-i-libxfont2-2-0-8-s-ustraneniem-uyazvimostej","title":{"rendered":"Update van X.Org Server 21.1.24, xwayland 24.1.13 en libXfont2 2.0.8 met het verhelpen van kwetsbaarheden","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrigerende releases van X.Org Server 21.1.24 en de DDX-component (Device-Dependent X) xwayland 24.1.13 zijn gepubliceerd, die de uitvoering van X11-applicaties in omgevingen gebaseerd op Wayland faciliteren. In de nieuwe versies zijn twee kwetsbaarheden verholpen die potentieel kunnen worden misbruikt voor privilege escalation in systemen waar de X-server met root-rechten draait, en ook voor remote code execution in configuraties waar toegang wordt verkregen via X11-sessieherleiding met SSH. <\/p>\n
Herstelde kwetsbaarheden: <\/p>\n
\n
CVE-2026-55999 \u2014 buffer overflow in the implementation of 2D acceleration architecture Glamor, affecting the function glamor_font_get(), which builds the font texture atlas by rendering each glyph in a common buffer. The issue arises because the buffer size was determined based on the parameters specified in the font, while creating the data copied to the buffer used individual metrics for each glyph. To exploit the vulnerability, an attacker can prepare a specially crafted file in PCF format, in which incorrect glyph metrics are defined that exceed the allocated MEMORY size for them. The overflow occurs on systems using the glamor backend (Xorg with the modesetting driver and Xwayland) when rendering text with the problematic font.\n
CVE-2026-56000 \u2014 use-after-free in the CommonMakeCurrent() function when processing GLX contextTags. The issue arises because when using the realloc() function, the data of the cl->contextTags array was moved to a new buffer, but a pointer referring to the old buffer remained in circulation. To initiate buffer relocation, the client could occupy all allocated elements of the GLX context array, after which an additional context could be created. <\/ul>\n