Skip to content
OpenAdvisories
Medium ALSA-2021:1804 9 CVEs

Moderate: userspace graphics, xorg-x11, and mesa security, bug fix, and enhancement update

Published May 18, 2021 · Updated Nov 5, 2026

Ecosystem: AlmaLinux

Summary

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Mesa provides a 3D graphics API that is compatible with Open Graphics Library (OpenGL). It also provides hardware-accelerated drivers for many popular graphics chips.

The following packages have been upgraded to a later upstream version: egl-wayland (1.1.5), libdrm (2.4.103), libglvnd (1.3.2), libinput (1.16.3), libwacom (1.6), mesa (20.3.3), xorg-x11-server (1.20.10). (BZ#1878160, BZ#1886648, BZ#1887654, BZ#1887655)

Security Fix(es):

* xorg-x11-server: Out-of-bounds access in XkbSetNames function (CVE-2020-14345)

* xorg-x11-server: Integer underflow in the X input extension protocol (CVE-2020-14346)

* xorg-x11-server: Out-of-bounds access in XkbSetMap function (CVE-2020-14360)

* xorg-x11-server: XkbSelectEvents integer underflow privilege escalation vulnerability (CVE-2020-14361)

* xorg-x11-server: XRecordRegisterClients integer underflow privilege escalation vulnerability (CVE-2020-14362)

* libX11: Integer overflow leads to double free in locale handling (CVE-2020-14363)

* xorg-x11-server: XkbSetDeviceInfo heap-based buffer overflow privilege escalation vulnerability (CVE-2020-25712)

* libX11: Heap overflow in the X input method client (CVE-2020-14344)

* xorg-x11-server: Leak of uninitialized heap memory from the X server to clients in AllocatePixmap of dix/pixmap.c (CVE-2020-14347)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 14

ReleasePackageFixed in
AlmaLinux · 8 libglvnd 1:1.3.2-1.el8
AlmaLinux · 8 libglvnd-core-devel 1:1.3.2-1.el8
AlmaLinux · 8 libglvnd-devel 1:1.3.2-1.el8
AlmaLinux · 8 libglvnd-egl 1:1.3.2-1.el8
AlmaLinux · 8 libglvnd-gles 1:1.3.2-1.el8
AlmaLinux · 8 libglvnd-glx 1:1.3.2-1.el8
AlmaLinux · 8 libglvnd-opengl 1:1.3.2-1.el8
AlmaLinux · 8 libinput-devel 1.16.3-1.el8
AlmaLinux · 8 libwacom-devel 1.6-2.el8
AlmaLinux · 8 mesa-libgbm-devel 20.3.3-2.el8
AlmaLinux · 8 mesa-libOSMesa-devel 20.3.3-2.el8
AlmaLinux · 8 xorg-x11-drivers 7.7-30.el8
AlmaLinux · 8 xorg-x11-server-devel 1.20.10-1.el8
AlmaLinux · 8 xorg-x11-server-source 1.20.10-1.el8

Vulnerabilities 9

References

  • report
    https://bugzilla.redhat.com/1826141
  • report
    https://bugzilla.redhat.com/1854920
  • report
    https://bugzilla.redhat.com/1856738
  • report
    https://bugzilla.redhat.com/1862241
  • report
    https://bugzilla.redhat.com/1862246
  • report
    https://bugzilla.redhat.com/1862255
  • report
    https://bugzilla.redhat.com/1862258
  • report
    https://bugzilla.redhat.com/1863142
  • report
    https://bugzilla.redhat.com/1869139
  • report
    https://bugzilla.redhat.com/1869142
  • report
    https://bugzilla.redhat.com/1869144
  • report
    https://bugzilla.redhat.com/1872473
  • report
    https://bugzilla.redhat.com/1878160
  • report
    https://bugzilla.redhat.com/1886644
  • report
    https://bugzilla.redhat.com/1886648
  • report
    https://bugzilla.redhat.com/1887276
  • report
    https://bugzilla.redhat.com/1887654
  • report
    https://bugzilla.redhat.com/1887655
  • report
    https://bugzilla.redhat.com/1891871
  • report
    https://bugzilla.redhat.com/1896442
  • report
    https://bugzilla.redhat.com/1897439
  • report
    https://bugzilla.redhat.com/1914411
  • advisory
    https://errata.almalinux.org/8/ALSA-2021-1804.html
  • report
    https://vulners.com/cve/CVE-2020-14344
  • report
    https://vulners.com/cve/CVE-2020-14345
  • report
    https://vulners.com/cve/CVE-2020-14346
  • report
    https://vulners.com/cve/CVE-2020-14347
  • report
    https://vulners.com/cve/CVE-2020-14360
  • report
    https://vulners.com/cve/CVE-2020-14361
  • report
    https://vulners.com/cve/CVE-2020-14362
  • report
    https://vulners.com/cve/CVE-2020-14363
  • report
    https://vulners.com/cve/CVE-2020-25712