Skip to content
OpenAdvisories
High ALAS2-2026-4108 0 CVEs

Important: xorg-x11-server security update (Amazon Linux 2)

Published Nov 12, 2026 · Updated Nov 12, 2026

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-109903: A flaw in the X.Org Server's XvQueryImageAttributes reply handling can result in clients receiving an incorrect data size value, potentially leading to improper buffer allocation or usage. CVE-2026-109096: A flaw in the X.Org Server's XvPutImage length validation can allow requests with missing image data to be processed, potentially leading to server crashes or misbehavior. CVE-2026-109095: An integer overflow flaw in the X.Org Server's glamor Xv image size computation can result in out-of-bounds reads, potentially leading to server crashes or unintended memory access. CVE-2026-109093: A flaw in the X.Org Server's XTestFakeInput handling can result in a stack out-of-bounds write, potentially leading to server crashes or stack memory corruption. CVE-2026-109092: A bounds-checking flaw in the X.Org Server's XvShmPutImage handling can result in an out-of-bounds read or write, potentially leading to server crashes or memory corruption. CVE-2026-109091: A flaw in the X.Org Server's handling of EDID Display-Range descriptors can result in an out-of-bounds write, potentially leading to server crashes or memory corruption.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2 xorg-x11-server-common 0:1.20.4-22.amzn2.0.15
Amazon Linux · 2 xorg-x11-server-debuginfo 0:1.20.4-22.amzn2.0.15
Amazon Linux · 2 xorg-x11-server-devel 0:1.20.4-22.amzn2.0.15
Amazon Linux · 2 xorg-x11-server-source 0:1.20.4-22.amzn2.0.15
Amazon Linux · 2 xorg-x11-server-Xdmx 0:1.20.4-22.amzn2.0.15
Amazon Linux · 2 xorg-x11-server-Xephyr 0:1.20.4-22.amzn2.0.15
Amazon Linux · 2 xorg-x11-server-Xnest 0:1.20.4-22.amzn2.0.15
Amazon Linux · 2 xorg-x11-server-Xorg 0:1.20.4-22.amzn2.0.15
Amazon Linux · 2 xorg-x11-server-Xvfb 0:1.20.4-22.amzn2.0.15
Amazon Linux · 2 xorg-x11-server-Xwayland 0:1.20.4-22.amzn2.0.15

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109091.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109092.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109093.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109095.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109096.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-109903.html