X.Org X11: Mehrere Schwachstellen ermöglichen nicht näher spezifizierte Auswirkungen, möglicherweise Codeausführung

Summary

Product

Vulnerabilities 8

• High 7.8
  CVE-2025-26594

  X.org: xwayland: use-after-free of the root cursor

  A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  Feb 25, 2025
• High 7.8
  CVE-2025-26595

  Xorg: xwayland: buffer overflow in xkbvmodmasktext()

  A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  Feb 25, 2025
• High 7.8
  CVE-2025-26596

  Xorg: xwayland: heap overflow in xkbwritekeysyms()

  A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Feb 25, 2025
• High 7.8
  CVE-2025-26597

  Xorg: xwayland: buffer overflow in xkbchangetypesofkey()

  A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, thi…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  Feb 25, 2025
• High 7.8
  CVE-2025-26598

  Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()

  An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the la…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  Feb 25, 2025
• High 7.8
  CVE-2025-26599

  Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

  An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  Feb 25, 2025
• High 7.8
  CVE-2025-26600

  Xorg: xwayland: use-after-free in playreleasedevents()

  A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  Feb 25, 2025
• High 7.8
  CVE-2025-26601

  Xorg: xwayland: use-after-free in syncinittrigger()

  A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes trigge…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux Alpine
  Feb 25, 2025

Revision history

1. 2026-09-21 #35

   Neue Updates von IBM aufgenommen

2. 2026-08-25 #34

   Neue Updates von Oracle Linux aufgenommen

3. 2026-08-13 #33

   Neue Updates von Oracle Linux aufgenommen

4. 2026-08-12 #32

   Neue Updates von Debian aufgenommen

5. 2026-07-27 #31

   Neue Updates von Red Hat aufgenommen

6. 2026-07-12 #30

   Neue Updates von Oracle Linux aufgenommen

7. 2026-07-08 #29

   Neue Updates von Red Hat aufgenommen

8. 2026-06-25 #28

   Neue Updates von Red Hat aufgenommen

9. 2026-06-17 #27

   Neue Updates von Red Hat aufgenommen

10. 2026-06-04 #26

    Korrektur

11. 2025-12-14 #25

    Neue Updates von Oracle Linux aufgenommen

12. 2025-12-10 #24

    Neue Updates von Oracle Linux aufgenommen

13. 2025-10-05 #23

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

14. 2025-10-01 #22

    Neue Updates von Dell aufgenommen

15. 2025-07-23 #21

    Neue Updates von Oracle Linux aufgenommen

16. 2025-07-07 #20

    Neue Updates von Oracle Linux aufgenommen

17. 2025-06-29 #19

    Neue Updates von Oracle Linux aufgenommen

18. 2025-06-12 #18

    Neue Updates von Gentoo aufgenommen

19. 2025-06-03 #17

    Neue Updates von SUSE aufgenommen

20. 2025-05-29 #16

    Neue Updates von Dell aufgenommen

21. 2025-05-18 #15

    Referenz(en) aufgenommen: EUVD-2025-5426, EUVD-2025-5425

22. 2025-05-13 #14

    Neue Updates von Red Hat aufgenommen

23. 2025-04-16 #13

    Neue Updates von Red Hat aufgenommen

24. 2025-04-07 #12

    Neue Updates von Oracle Linux aufgenommen

25. 2025-03-31 #11

    Neue Updates von Oracle Linux aufgenommen

References

• X.Org Security Advisory vom 2025-02-25
  https://seclists.org/oss-sec/2025/q1/159
• Ubuntu Security Notice USN-7299-1 vom 2025-02-25
  https://ubuntu.com/security/notices/USN-7299-1
• Xming Changelog vom 2025-02-25
  http://www.straightrunning.com/XmingNotes/changes.php
• Fedora Security Advisory FEDORA-2025-FD490BCDCD vom 2025-02-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-fd490bcdcd
• Fedora Security Advisory FEDORA-2025-F2525743D6 vom 2025-02-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-f2525743d6
• Fedora Security Advisory FEDORA-2025-B40B12A89E vom 2025-02-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-b40b12a89e
• OpenBSD Errata
  https://www.openbsd.org/errata76.html
• Fedora Security Advisory FEDORA-2025-065909F8C6 vom 2025-02-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-065909f8c6
• Fedora Security Advisory FEDORA-2025-4A832BF2B1 vom 2025-02-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-4a832bf2b1
• Fedora Security Advisory FEDORA-2025-2210D27149 vom 2025-02-26
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-2210d27149
• SUSE Security Update SUSE-SU-2025:0732-1 vom 2025-02-26
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/TAWVWOHNPE3MMAI6UKCA47A6ZA5I434J/
• SUSE Security Update SUSE-SU-2025:0731-1 vom 2025-02-26
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CCWOXQOHRYOB3XBTE3E6CKLLTFNLQAMR/
• SUSE Security Update SUSE-SU-2025:0730-1 vom 2025-02-26
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ZKUPIGIXHBM4MC4CXVLM3OB32L2TMUTV/
• SUSE Security Update SUSE-SU-2025:0729-1 vom 2025-02-26
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/5GTDDAPT2CXHXVOSK7DE6OWNPU5YPGYR/
• SUSE Security Update SUSE-SU-2025:0733-1 vom 2025-02-26
  https://lists.suse.com/pipermail/sle-security-updates/2025-February/020438.html
• SUSE Security Update SUSE-SU-2025:0734-1 vom 2025-02-26
  https://lists.suse.com/pipermail/sle-security-updates/2025-February/020437.html
• SUSE Security Update SUSE-SU-2025:0731-1 vom 2025-02-26
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/CCWOXQOHRYOB3XBTE3E6CKLLTFNLQAMR/
• openSUSE Security Update OPENSUSE-SU-2025:14841-1 vom 2025-02-27
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/DFXFWTIBYVEZW7776X7CR2CMJGQXCGXT/
• Debian Security Advisory DLA-4072 vom 2025-03-01
  https://lists.debian.org/debian-lts-announce/2025/02/msg00036.html
• SUSE Security Update SUSE-SU-2025:0758-1 vom 2025-02-28
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/27GANBYQW25DQC6LDPTKCLJHEVLSI5SU/
• Fedora Security Advisory FEDORA-2025-EF7FB833F2 vom 2025-03-03
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-ef7fb833f2
• SUSE Security Update SUSE-SU-2025:0757-1 vom 2025-02-28
  https://lists.suse.com/pipermail/sle-security-updates/2025-February/020459.html
• SUSE Security Update SUSE-SU-2025:0739-1 vom 2025-02-28
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/MV377NV3DYCGULIZJDMJOW3QERLQFGCB/
• Debian Security Advisory DSA-5872 vom 2025-02-28
  https://lists.debian.org/debian-security-announce/2025/msg00034.html
• SUSE Security Update SUSE-SU-2025:0740-1 vom 2025-02-28
  https://lists.suse.com/pipermail/sle-security-updates/2025-February/020454.html
• Fedora Security Advisory FEDORA-2025-A87BC329FE vom 2025-03-03
  https://bodhi.fedoraproject.org/updates/FEDORA-2025-a87bc329fe
• Ubuntu Security Notice USN-7299-2 vom 2025-03-10
  https://ubuntu.com/security/notices/USN-7299-2
• Oracle Linux Security Advisory ELSA-2025-2500 vom 2025-03-11
  https://linux.oracle.com/errata/ELSA-2025-2500.html
• Red Hat Security Advisory RHSA-2025:2502 vom 2025-03-10
  https://access.redhat.com/errata/RHSA-2025:2502
• SUSE Security Update SUSE-SU-2025:0818-1 vom 2025-03-10
  https://lists.suse.com/pipermail/sle-security-updates/2025-March/020494.html
• Oracle Linux Security Advisory ELSA-2025-2502 vom 2025-03-11
  https://linux.oracle.com/errata/ELSA-2025-2502.html
• Red Hat Security Advisory RHSA-2025:2500 vom 2025-03-10
  https://access.redhat.com/errata/RHSA-2025:2500
• Ubuntu Security Notice USN-7299-3 vom 2025-03-12
  https://ubuntu.com/security/notices/USN-7299-3
• Red Hat Security Advisory RHSA-2025:2865 vom 2025-03-17
  https://access.redhat.com/errata/RHSA-2025:2865
• Red Hat Security Advisory RHSA-2025:2874 vom 2025-03-17
  https://access.redhat.com/errata/RHSA-2025:2874
• Red Hat Security Advisory RHSA-2025:2875 vom 2025-03-17
  https://access.redhat.com/errata/RHSA-2025:2875
• Red Hat Security Advisory RHSA-2025:2880 vom 2025-03-17
  https://access.redhat.com/errata/RHSA-2025:2880
• Red Hat Security Advisory RHSA-2025:2866 vom 2025-03-17
  https://access.redhat.com/errata/RHSA-2025:2866
• Red Hat Security Advisory RHSA-2025:2861 vom 2025-03-17
  https://access.redhat.com/errata/RHSA-2025:2861
• Red Hat Security Advisory RHSA-2025:2873 vom 2025-03-17
  https://access.redhat.com/errata/RHSA-2025:2873
• Red Hat Security Advisory RHSA-2025:2879 vom 2025-03-17
  https://access.redhat.com/errata/RHSA-2025:2879
• Red Hat Security Advisory RHSA-2025:2862 vom 2025-03-17
  https://access.redhat.com/errata/RHSA-2025:2862
• Ubuntu Security Notice USN-7299-4 vom 2025-03-17
  https://ubuntu.com/security/notices/USN-7299-4
• Amazon Linux Security Advisory ALAS-2025-2791 vom 2025-03-26
  https://alas.aws.amazon.com/AL2/ALAS-2025-2791.html
• IGEL Security Notice ISN-2025-07 vom 2025-03-27
  https://kb.igel.com/security-safety/current/isn-2025-07-x-org-vulnerabilities
• Oracle Linux Security Advisory ELSA-2025-2861 vom 2025-04-01
  https://linux.oracle.com/errata/ELSA-2025-2861.html
• Oracle Linux Security Advisory ELSA-2025-2879 vom 2025-04-08
  https://linux.oracle.com/errata/ELSA-2025-2879.html
• Red Hat Security Advisory RHSA-2025:3976 vom 2025-04-17
  https://access.redhat.com/errata/RHSA-2025:3976
• Red Hat Security Advisory RHSA-2025:7458 vom 2025-05-13
  https://access.redhat.com/errata/RHSA-2025:7458
• Red Hat Security Advisory RHSA-2025:7163 vom 2025-05-13
  https://access.redhat.com/errata/RHSA-2025:7163
• Red Hat Security Advisory RHSA-2025:7165 vom 2025-05-13
  https://access.redhat.com/errata/RHSA-2025:7165
• Dell Security Advisory DSA-2025-213 vom 2025-05-30
  https://www.dell.com/support/kbdoc/de-de/000326299/dsa-2025-213-security-update-for-dell-avamar-dell-networker-virtual-edition-nve-and-dell-powerprotect-dp-series-appliance-dell-integrated-data-protection-appliance-idpa-multiple-third-party-vulnerabilities
• SUSE Security Update SUSE-SU-2025:20299-1 vom 2025-06-04
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021033.html
• SUSE Security Update SUSE-SU-2025:20161-1 vom 2025-06-04
  https://lists.suse.com/pipermail/sle-security-updates/2025-June/021189.html
• Gentoo Linux Security Advisory GLSA-202506-04 vom 2025-06-12
  https://security.gentoo.org/glsa/202506-04
• Oracle Linux Security Advisory ELSA-2025-9304 vom 2025-06-28
  http://linux.oracle.com/errata/ELSA-2025-9304.html
• Oracle Linux Security Advisory ELSA-2025-7458 vom 2025-07-07
  https://linux.oracle.com/errata/ELSA-2025-7458.html
• Oracle Linux Security Advisory ELSA-2025-10360 vom 2025-07-24
  https://linux.oracle.com/errata/ELSA-2025-10360.html
• Dell Security Update vom 2025-10-02
  https://www.dell.com/support/kbdoc/000376224
• Rocky Linux Security Advisory RLSA-2025:7163 vom 2025-10-04
  https://errata.build.resf.org/RLSA-2025:7163
• Oracle Linux Security Advisory ELSA-2025-22096 vom 2025-12-11
  http://linux.oracle.com/errata/ELSA-2025-22096.html
• Oracle Linux Security Advisory ELSA-2025-22040 vom 2025-12-12
  https://linux.oracle.com/errata/ELSA-2025-22040.html
• Red Hat Security Advisory RHSA-2026:26590 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26590
• Red Hat Security Advisory RHSA-2026:26562 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26562
• Red Hat Security Advisory RHSA-2026:26610 vom 2026-06-18
  https://access.redhat.com/errata/RHSA-2026:26610
• Red Hat Security Advisory RHSA-2026:29844 vom 2026-06-25
  https://access.redhat.com/errata/RHSA-2026:29844
• Red Hat Security Advisory RHSA-2026:36791 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36791
• Red Hat Security Advisory RHSA-2026:36792 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36792
• Oracle Linux Security Advisory ELSA-2026-20590 vom 2026-07-09
  https://linux.oracle.com/errata/ELSA-2026-20590.html
• Oracle Linux Security Advisory ELSA-2026-22456 vom 2026-07-10
  http://linux.oracle.com/errata/ELSA-2026-22456.html
• Red Hat Security Advisory RHSA-2026:38502 vom 2026-07-13
  https://access.redhat.com/errata/RHSA-2026:38502
• Red Hat Security Advisory RHSA-2026:46473 vom 2026-07-27
  https://access.redhat.com/errata/RHSA-2026:46473
• Debian Security Advisory DLA-4737 vom 2026-08-13
  https://lists.debian.org/debian-lts-announce/2026/08/msg00026.html
• Debian Security Advisory DLA-4738 vom 2026-08-13
  https://lists.debian.org/debian-lts-announce/2026/08/msg00027.html
• Oracle Linux Security Advisory ELSA-2026-36083 vom 2026-08-14
  https://linux.oracle.com/errata/ELSA-2026-36083.html
• Oracle Linux Security Advisory ELSA-2026-50117 vom 2026-08-26
  https://linux.oracle.com/errata/ELSA-2026-50117-0.html
• IBM Security Bulletin 7288809 vom 2026-09-22
  https://www.ibm.com/support/pages/node/7288809