RLSA-2025:7458
RLSA-2025:7458 · Important: xorg-x11-server-Xwayland security update
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Xwayland is an X server for running X clients under Wayland. Security Fix(es): * xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632) * X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594) * xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601) * xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600) * xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599) * xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598) * xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597) * xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596) * Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVSS 7.8 · High · Fix available
- Published
- Updated
Stack: system
Affected products and versions
xorg-x11-server-xwayland Rocky Linux:10
- Affected ranges
- ECOSYSTEM: < 0:24.1.5-3.el10_0
Update to 0:24.1.5-3.el10_0
Original sources
- https://errata.rockylinux.org/RLSA-2025:7458
- https://bugzilla.redhat.com/show_bug.cgi?id=2317233
- https://bugzilla.redhat.com/show_bug.cgi?id=2345248
- https://bugzilla.redhat.com/show_bug.cgi?id=2345251
- https://bugzilla.redhat.com/show_bug.cgi?id=2345252
- https://bugzilla.redhat.com/show_bug.cgi?id=2345253
- https://bugzilla.redhat.com/show_bug.cgi?id=2345254
- https://bugzilla.redhat.com/show_bug.cgi?id=2345255
- https://bugzilla.redhat.com/show_bug.cgi?id=2345256
- https://bugzilla.redhat.com/show_bug.cgi?id=2345257
- https://osv.dev/vulnerability/RLSA-2025:7458