This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] X.Org X server and Xwayland fix 8 high-severity vulnerabilities
X.Org X server with version 21.1.16 and Xwayland with version 24.1.6 fix 8 vulnerabilities. The fixes are also available in commits, a list of which can be found at [1]. Among operating systems, a fix has been released by Slackware as SSA:2025-056-01 [2] and by Ubuntu [3][4][5][6][7][8][9][10]. Debian released a fix only for the unstable sid distribution in version 2:21.1.16-1 (package xorg-server) and 2:24.1.6-1 (package xwayland) [11][12]; Gentoo fixed the vulnerabilities in testing versions [13][14]. Individual Ubuntu releases (packages in the order xorg-server and xwayland) and fixed product versions [3][4][5][6][7][8][9][10]: oracular - 2:21.1.13-2ubuntu1.2 and 2:24.1.2-1ubuntu0.4; noble - 2:21.1.12-1ubuntu1.2 and 2:23.2.6-1ubuntu0.4; jammy - 2:21.1.4-2ubuntu1.7~22.04.13 and 2:22.1.1-1ubuntu0.17; focal - 2:1.20.13-1ubuntu1~20.04.19 (xorg-server).
Due to a use-after-free vulnerability, an authenticated local attacker can access memory without authorization [1].
The vulnerability is present in products:
- *:X.Org X server;<21.1.16;
- *:Xwayland;<24.1.6;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-26594 at cve.org, NVD
- CVE-2025-26600 at cve.org, NVD
- CVE-2025-26601 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 25. 2. 2025.
An authenticated local attacker can access memory outside the bounds of allocated memory without authorization [1].
The vulnerability is present in products:
- *:X.Org X server;<21.1.16;
- *:Xwayland;<24.1.6;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-26595 at cve.org, NVD
- CVE-2025-26596 at cve.org, NVD
- CVE-2025-26597 at cve.org, NVD
- CVE-2025-26598 at cve.org, NVD
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org
The vulnerability was publicly disclosed 25. 2. 2025.
Due to access to an uninitialized pointer, an authenticated local attacker can access memory without authorization [1].
The vulnerability is present in products:
- *:X.Org X server;<21.1.16;
- *:Xwayland;<24.1.6;
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-26599 at cve.org, NVD
- CWE-824: Access of Uninitialized Pointer at cwe.mitre.org
The vulnerability was publicly disclosed 25. 2. 2025.
Links
- [1] https://www.openwall.com/lists/oss-security/2025/02/25/1
- [2] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2025&m=slackware-security.772545
- [3] https://ubuntu.com/security/CVE-2025-26594
- [4] https://ubuntu.com/security/CVE-2025-26595
- [5] https://ubuntu.com/security/CVE-2025-26596
- [6] https://ubuntu.com/security/CVE-2025-26597
- [7] https://ubuntu.com/security/CVE-2025-26598
- [8] https://ubuntu.com/security/CVE-2025-26599
- [9] https://ubuntu.com/security/CVE-2025-26600
- [10] https://ubuntu.com/security/CVE-2025-26601
- [11] https://security-tracker.debian.org/tracker/source-package/xorg-server
- [12] https://security-tracker.debian.org/tracker/source-package/xwayland
- [13] https://packages.gentoo.org/packages/x11-base/xorg-server
- [14] https://packages.gentoo.org/packages/x11-base/xwayland
By CESNET, z.s.p.o. Michaela Ručková on 27. 2. 2025.