Threat Intelligence Database

This update for xwayland fixes the following issues - CVE-2026-55999: missing bounds check in `glamor_font_get` can lead to a heap buffer overflow when a font loaded from a malicious PCF file is processed (bsc#1268893). - CVE-2026-56000: improper memory management in `CommonMakeCurrent` can lead to a heap use-after-free when an interaction with a malicious client creating GLX contexts happens (bsc#1268894).

CVE-2026-34002 is a medium severity vulnerability in the X.Org X server's X Keyboard Extension (XKB) modifier map handling. It is an out-of-bounds read flaw that can be exploited by an attacker with access to the X11 server by sending a malformed request. Successful exploitation may lead to information disclosure or cause the server to crash, resulting in denial of service. Red Hat has released security advisories and updates addressing this issue in affected Red Hat Enterprise Linux 9.x Extended Update Support and Update Services for SAP Solutions versions.

This update for xorg-x11-server fixes the following issues: - CVE-2025-62229: Fixed use-after-free in XPresentNotify structures creation (bsc#1251958). - CVE-2025-62230: Fixed use-after-free in Xkb client resource removal (bsc#1251959). - CVE-2025-62231: Fixed value overflow in Xkb extension XkbSetCompatMap() (bsc#1251960).

This update for xorg-x11-server fixes the following issues: - CVE-2025-62229: Fixed use-after-free in XPresentNotify structures creation (bsc#1251958). - CVE-2025-62230: Fixed use-after-free in Xkb client resource removal (bsc#1251959). - CVE-2025-62231: Fixed value overflow in Xkb extension XkbSetCompatMap() (bsc#1251960).

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229) * xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230) * xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Security Fix(es): * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179) * xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities have been identified and fixed in the xorg-x11-server component of Red Hat Enterprise Linux 9. These include a heap-based buffer overflow privilege escalation vulnerability in tigervnc (CVE-2024-9632) and several use-after-free, buffer overflow, heap overflow, out-of-bounds write, and uninitialized pointer vulnerabilities in Xwayland and related components (CVE-2025-26594 through CVE-2025-26601). Red Hat has released security updates addressing these issues with a moderate severity rating.

Red Hat has issued a security advisory for tigervnc in Red Hat Enterprise Linux 7 addressing three vulnerabilities in the xorg-x11-server component. These include two heap buffer overread/data leakage issues (CVE-2024-31080 and CVE-2024-31081) and one use-after-free vulnerability (CVE-2024-31083). The vulnerabilities could lead to data leakage or memory corruption. Red Hat has released patches to fix these issues. The update is rated with an important security impact and affects multiple Red Hat Enterprise Linux 7 variants.

Multiple security vulnerabilities have been identified in the xorg-x11-server component of Red Hat Enterprise Linux 9, including heap buffer overread/data leakage and use-after-free issues. These vulnerabilities affect the X.Org server, which provides core graphical interface functionality. The issues have been rated with moderate severity by Red Hat Product Security. A security update addressing these vulnerabilities is available and should be applied to affected systems.