X.Org X11 und Xwayland: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 9

• High 7.8
  CVE-2026-50256

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch

  A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 by…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50257

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence()

  A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50258

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb key types due to unchecked shift levels

  A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A clien…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50259

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in xkb setmap request via mapwidths indexing

  A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled o…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50260

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter()

  A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50261

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in syncchangecounter()

  A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. Th…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• High 7.8
  CVE-2026-50264

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds heap write in dri2 drigetbuffers/drigetbufferswithformat

  An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• Medium 5.5
  CVE-2026-50262

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes

  An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A wri…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026
• Medium 5.5
  CVE-2026-50263

  Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow()

  A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 6 Linux Debian Ubuntu Azure Linux
  Jun 5, 2026

Revision history

1. 2026-11-10 #23

   Referenz(en) aufgenommen: ZDI-26-903, ZDI-CAN-30444, ZDI-26-902, ZDI-CAN-30443, ZDI-26-901, ZDI-CAN-30557

2. 2026-10-21 #22

   Neue Updates von IBM aufgenommen

3. 2026-09-21 #21

   Neue Updates von IBM aufgenommen

4. 2026-08-25 #20

   Neue Updates von Oracle Linux aufgenommen

5. 2026-08-16 #19

   Neue Updates von Gentoo aufgenommen

6. 2026-08-13 #18

   Neue Updates von Oracle Linux aufgenommen

7. 2026-08-12 #17

   Neue Updates von Debian aufgenommen

8. 2026-07-26 #16

   Neue Updates von Red Hat aufgenommen

9. 2026-07-20 #15

   Neue Updates von Oracle Linux aufgenommen

10. 2026-07-16 #14

    Neue Updates von Oracle Linux aufgenommen

11. 2026-07-12 #13

    Neue Updates von Red Hat aufgenommen

12. 2026-07-08 #12

    Neue Updates von Red Hat aufgenommen

13. 2026-07-07 #11

    Neue Updates von Amazon aufgenommen

14. 2026-07-06 #10

    Neue Updates von Red Hat aufgenommen

15. 2026-06-28 #9

    Neue Updates von Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

16. 2026-06-25 #8

    Neue Updates von Oracle Linux und Red Hat aufgenommen

17. 2026-06-24 #7

    Neue Updates von Zero Day Initiative, Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

18. 2026-06-18 #6

    Neue Updates von Rocky Enterprise Software Foundation und Fedora aufgenommen

19. 2026-06-17 #5

    Neue Updates von Oracle Linux und Red Hat aufgenommen

20. 2026-06-09 #4

    Neue Updates aufgenommen

21. 2026-06-07 #3

    Referenz(en) aufgenommen: EUVD-2026-34815, EUVD-2026-34820, EUVD-2026-34819, EUVD-2026-34818, EUVD-2026-34817, EUVD-2026-34816, EUVD-2026-34814, EUVD-2026-34813, EUVD-2026-34812

22. 2026-06-04 #2

    CVE-Nummern ergänzt

23. 2026-06-01 #1

    Initiale Fassung

References

• X.Org Security Advisory vom 2026-06-01
  https://lists.x.org/archives/xorg-announce/2026-June/003702.html
• Microsoft Security Update Guide vom 2026-06-09
  https://msrc.microsoft.com/update-guide/
• Oracle Linux Security Advisory ELSA-2026-26562 vom 2026-06-18
  https://linux.oracle.com/errata/ELSA-2026-26562.html
• Red Hat Security Advisory RHSA-2026:26610 vom 2026-06-18
  https://access.redhat.com/errata/RHSA-2026:26610
• Red Hat Security Advisory RHSA-2026:26562 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26562
• Oracle Linux Security Advisory ELSA-2026-26709 vom 2026-06-18
  https://linux.oracle.com/errata/ELSA-2026-26709.html
• Red Hat Security Advisory RHSA-2026:26590 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26590
• Red Hat Security Advisory RHSA-2026:26709 vom 2026-06-17
  https://access.redhat.com/errata/RHSA-2026:26709
• Rocky Linux Security Advisory RLSA-2026:26562 vom 2026-06-19
  https://errata.build.resf.org/RLSA-2026:26562
• Rocky Linux Security Advisory RLSA-2026:26590 vom 2026-06-19
  https://errata.build.resf.org/RLSA-2026:26590
• Rocky Linux Security Advisory RLSA-2026:26709 vom 2026-06-19
  https://errata.build.resf.org/RLSA-2026:26709
• Fedora Security Advisory FEDORA-2026-E7C97D043E vom 2026-06-18
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-e7c97d043e
• Fedora Security Advisory FEDORA-2026-AD10AFA9CD vom 2026-06-18
  https://bodhi.fedoraproject.org/updates/FEDORA-2026-ad10afa9cd
• Rocky Linux Security Advisory RLSA-2026:26610 vom 2026-06-19
  https://errata.build.resf.org/RLSA-2026:26610
• Rocky Linux Security Advisory RLSA-2026:26566 vom 2026-06-24
  https://errata.build.resf.org/RLSA-2026:26566
• Rocky Linux Security Advisory RLSA-2026:28923 vom 2026-06-25
  https://errata.build.resf.org/RLSA-2026:28923
• Oracle Linux Security Advisory ELSA-2026-28923 vom 2026-06-25
  http://linux.oracle.com/errata/ELSA-2026-28923.html
• Oracle Linux Security Advisory ELSA-2026-26590 vom 2026-06-25
  https://linux.oracle.com/errata/ELSA-2026-26590.html
• Oracle Linux Security Advisory ELSA-2026-26610 vom 2026-06-26
  http://linux.oracle.com/errata/ELSA-2026-26610.html
• Oracle Linux Security Advisory ELSA-2026-29844 vom 2026-06-26
  http://linux.oracle.com/errata/ELSA-2026-29844.html
• Red Hat Security Advisory RHSA-2026:29844 vom 2026-06-25
  https://access.redhat.com/errata/RHSA-2026:29844
• Oracle Linux Security Advisory ELSA-2026-19343 vom 2026-06-27
  https://linux.oracle.com/errata/ELSA-2026-19343.html
• Oracle Linux Security Advisory ELSA-2026-19344 vom 2026-06-27
  https://linux.oracle.com/errata/ELSA-2026-19344.html
• Rocky Linux Security Advisory RLSA-2026:29844 vom 2026-06-26
  https://errata.build.resf.org/RLSA-2026:29844
• Red Hat Security Advisory RHSA-2026:36083 vom 2026-07-07
  https://access.redhat.com/errata/RHSA-2026:36083
• Red Hat Security Advisory RHSA-2026:36087 vom 2026-07-07
  https://access.redhat.com/errata/RHSA-2026:36087
• Red Hat Security Advisory RHSA-2026:36086 vom 2026-07-07
  https://access.redhat.com/errata/RHSA-2026:36086
• Amazon Linux Security Advisory ALAS2-2026-3792 vom 2026-07-08
  https://alas.aws.amazon.com/AL2/ALAS2-2026-3792.html
• Red Hat Security Advisory RHSA-2026:36632 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36632
• Red Hat Security Advisory RHSA-2026:36633 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36633
• Red Hat Security Advisory RHSA-2026:36634 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36634
• Red Hat Security Advisory RHSA-2026:36768 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36768
• Red Hat Security Advisory RHSA-2026:36798 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36798
• Red Hat Security Advisory RHSA-2026:36792 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36792
• Red Hat Security Advisory RHSA-2026:36791 vom 2026-07-08
  https://access.redhat.com/errata/RHSA-2026:36791
• Red Hat Security Advisory RHSA-2026:38502 vom 2026-07-13
  https://access.redhat.com/errata/RHSA-2026:38502
• Red Hat Security Advisory RHSA-2026:38810 vom 2026-07-13
  https://access.redhat.com/errata/RHSA-2026:38810
• Oracle Linux Security Advisory ELSA-2026-26566 vom 2026-07-17
  https://linux.oracle.com/errata/ELSA-2026-26566.html
• Oracle Linux Security Advisory ELSA-2026-19125 vom 2026-07-21
  https://linux.oracle.com/errata/ELSA-2026-19125.html
• Red Hat Security Advisory RHSA-2026:46460 vom 2026-07-27
  https://access.redhat.com/errata/RHSA-2026:46460
• Red Hat Security Advisory RHSA-2026:46456 vom 2026-07-27
  https://access.redhat.com/errata/RHSA-2026:46456
• Red Hat Security Advisory RHSA-2026:46382 vom 2026-07-27
  https://access.redhat.com/errata/RHSA-2026:46382
• Red Hat Security Advisory RHSA-2026:46377 vom 2026-07-27
  https://access.redhat.com/errata/RHSA-2026:46377
• Red Hat Security Advisory RHSA-2026:46473 vom 2026-07-27
  https://access.redhat.com/errata/RHSA-2026:46473
• Red Hat Security Advisory RHSA-2026:46385 vom 2026-07-27
  https://access.redhat.com/errata/RHSA-2026:46385
• Red Hat Security Advisory RHSA-2026:46392 vom 2026-07-27
  https://access.redhat.com/errata/RHSA-2026:46392
• Debian Security Advisory DLA-4737 vom 2026-08-13
  https://lists.debian.org/debian-lts-announce/2026/08/msg00026.html
• Debian Security Advisory DLA-4738 vom 2026-08-13
  https://lists.debian.org/debian-lts-announce/2026/08/msg00027.html
• Oracle Linux Security Advisory ELSA-2026-36083 vom 2026-08-14
  https://linux.oracle.com/errata/ELSA-2026-36083.html
• Gentoo Linux Security Advisory GLSA-202608-14 vom 2026-08-17
  https://security.gentoo.org/glsa/202608-14
• Oracle Linux Security Advisory ELSA-2026-50117 vom 2026-08-26
  https://linux.oracle.com/errata/ELSA-2026-50117-0.html
• IBM Security Bulletin 7288809 vom 2026-09-22
  https://www.ibm.com/support/pages/node/7288809
• IBM Security Bulletin 7293281 vom 2026-10-21
  https://www.ibm.com/support/pages/node/7293281