This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] X.Org X server and Xwayland fix 3 vulnerabilities
X.Org X server versions 21.1.19 and Xwayland versions 24.1.9 fix 3 vulnerabilities. The fixes are also available in commits, a list of which can be found at [1]. Among operating systems, a fix was released by Slackware within SSA:2025-302-01 [2], and by Debian for bullseye in version 2:1.20.11-1+deb11u17 [3], bookworm in version 2:21.1.7-3+deb12u11 [4] and trixie in version 2:21.1.16-1.3+deb13u1 [4] (xorg-server). Gentoo fixed the vulnerabilities in versions 21.1.20 for xorg-server and 24.1.9 for xwayland [5]. Individual Ubuntu releases (packages in the order xorg-server and xwayland) and fixed product versions [6][7][8]: questing - 2:21.1.18-1ubuntu1.1 and 2:24.1.6-1ubuntu1.1; plucky - 2:21.1.16-1ubuntu1.2 and 2:24.1.6-1ubuntu0.2; noble - 2:21.1.12-1ubuntu1.5 and 2:23.2.6-1ubuntu0.7; jammy - 2:21.1.4-2ubuntu1.7~22.04.16 and 2:22.1.1-1ubuntu0.20.
Due to a use after free vulnerability, an authenticated remote attacker can access memory without authorization [1].
The vulnerability is present in products:
- X.Org X server; <=21.1.18
- Xwayland; <=24.1.8
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-62229 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 28. 10. 2025.
Due to a use after free vulnerability, an authenticated remote attacker can access memory without authorization [1].
The vulnerability is present in products:
- X.Org X server; <=21.1.18
- Xwayland; <=24.1.8
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-62230 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 28. 10. 2025.
Due to an integer overflow, an authenticated remote attacker can corrupt memory or carry out a DoS attack [1].
The vulnerability is present in products:
- X.Org X server; <=21.1.18
- Xwayland; <=24.1.8
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-62231 at cve.org, NVD
- CWE-190: Integer overflow at cwe.mitre.org
The vulnerability was publicly disclosed 28. 10. 2025.
Links
- [1] https://lists.x.org/archives/xorg-announce/2025-October/003635.html
- [2] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2025&m=slackware-security.707848
- [3] https://security-tracker.debian.org/tracker/DLA-4353-1
- [4] https://security-tracker.debian.org/tracker/DSA-6044-1
- [5] https://bugs.gentoo.org/965271
- [6] https://ubuntu.com/security/CVE-2025-62229
- [7] https://ubuntu.com/security/CVE-2025-62230
- [8] https://ubuntu.com/security/CVE-2025-62231
By CESNET, z.s.p.o. Michaela Jarošová on 30. 10. 2025.