Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-109903: A flaw in the X.Org Server's XvQueryImageAttributes reply handling can result in clients receiving an incorrect data size value, potentially leading to improper buffer allocation or usage. CVE-2026-109096: A flaw in the X.Org Server's XvPutImage length validation can allow requests with missing image data to be processed, potentially leading to server crashes or misbehavior. CVE-2026-109095: An integer overflow flaw in the X.Org Server's glamor Xv image size computation can result in out-of-bounds reads, potentially leading to server crashes or unintended memory access. CVE-2026-109093: A flaw in the X.Org Server's XTestFakeInput handling can result in a stack out-of-bounds write, potentially leading to server crashes or stack memory corruption. CVE-2026-109092: A bounds-checking flaw in the X.Org Server's XvShmPutImage handling can result in an out-of-bounds read or write, potentially leading to server crashes or memory corruption.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | xorg-x11-server-Xwayland | 0:24.1.3-1.amzn2023.0.8 |
| Amazon Linux · 2023 | xorg-x11-server-Xwayland-debuginfo | 0:24.1.3-1.amzn2023.0.8 |
| Amazon Linux · 2023 | xorg-x11-server-Xwayland-debugsource | 0:24.1.3-1.amzn2023.0.8 |
| Amazon Linux · 2023 | xorg-x11-server-Xwayland-devel | 0:24.1.3-1.amzn2023.0.8 |
Vulnerabilities 5
-
High 8.5
A stack buffer overflow in ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server be…
-
High 7.8
X.Org Server XvShmPutImage Shared-Memory Bounds Overflow
Incorrectly handled negative sizes when processing ProcXvShmPutImage requests in the X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by local authenticated X clients to crash the X server or execute code.
-
High 7.8
X.Org Server XvQueryImageAttributes Negative Size Reply
A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.
-
Medium 6.9
X.Org Server glamor Xv Image Size Integer Overflow
A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash the X server or leak out data.
-
Medium 5.5
Incorrect handling of negative returns from ddQueryImageAttributes() when processing XvPutImage requests in X.Org xwayl…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-109092.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-109093.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-109095.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-109096.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-109903.html