UbuntuUpdates.org

Package "xorg-server"

Name: xorg-server

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Nested X server
  • Xorg X server - source files
  • Virtual Framebuffer 'fake' X server

Latest version: 2:21.1.13-2ubuntu1.2
Release: oracular (24.10)
Level: security
Repository: universe

Links



Other versions of "xorg-server" in Oracular

Repository Area Version
base universe 2:21.1.13-2ubuntu1
base main 2:21.1.13-2ubuntu1
security main 2:21.1.13-2ubuntu1.2
updates main 2:21.1.13-2ubuntu1.2
updates universe 2:21.1.13-2ubuntu1.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2:21.1.13-2ubuntu1.2 2025-02-25 20:07:06 UTC

  xorg-server (2:21.1.13-2ubuntu1.2) oracular-security; urgency=medium

  * SECURITY UPDATE: Use-after-free of the root cursor
    - debian/patches/CVE-2025-26594-1.patch: refuse to free the root cursor
      in dix/dispatch.c.
    - debian/patches/CVE-2025-26594-2.patch: keep a ref to the rootCursor
      in dix/main.c.
    - CVE-2025-26594
  * SECURITY UPDATE: Buffer overflow in XkbVModMaskText()
    - debian/patches/CVE-2025-26595.patch: fix bounds check in
      xkb/xkbtext.c.
    - CVE-2025-26595
  * SECURITY UPDATE: Heap overflow in XkbWriteKeySyms()
    - debian/patches/CVE-2025-26596.patch: fix computation of
      XkbSizeKeySyms in xkb/xkb.c.
    - CVE-2025-26596
  * SECURITY UPDATE: Buffer overflow in XkbChangeTypesOfKey()
    - debian/patches/CVE-2025-26597.patch: also resize key actions in
      xkb/XKBMisc.c.
    - CVE-2025-26597
  * SECURITY UPDATE: Out-of-bounds write in CreatePointerBarrierClient()
    - debian/patches/CVE-2025-26598.patch: fix barrier device search in
      Xi/xibarriers.c.
    - CVE-2025-26598
  * SECURITY UPDATE: Use of uninitialized pointer in compRedirectWindow()
    - debian/patches/CVE-2025-26599-1.patch: handle failure to redirect in
      composite/compalloc.c.
    - debian/patches/CVE-2025-26599-2.patch: initialize border clip even
      when pixmap alloc fails in composite/compalloc.c.
    - CVE-2025-26599
  * SECURITY UPDATE: Use-after-free in PlayReleasedEvents()
    - debian/patches/CVE-2025-26600.patch: dequeue pending events on frozen
      device on removal in dix/devices.c.
    - CVE-2025-26600
  * SECURITY UPDATE: Use-after-free in SyncInitTrigger()
    - debian/patches/CVE-2025-26601-1.patch: do not let sync objects
      uninitialized in Xext/sync.c.
    - debian/patches/CVE-2025-26601-2.patch: check values before applying
      changes in Xext/sync.c.
    - debian/patches/CVE-2025-26601-3.patch: do not fail
      SyncAddTriggerToSyncObject() in Xext/sync.c.
    - debian/patches/CVE-2025-26601-4.patch: apply changes last in
      SyncChangeAlarmAttributes() in Xext/sync.c.
    - CVE-2025-26601

 -- Marc Deslauriers <email address hidden> Wed, 19 Feb 2025 08:08:11 -0500

Source diff to previous version
CVE-2025-26594 A use-after-free flaw was found in X.Org and Xwayland. The root cursor ...
CVE-2025-26595 A buffer overflow flaw was found in X.Org and Xwayland. The code in Xk ...
CVE-2025-26596 A heap overflow flaw was found in X.Org and Xwayland. The computation ...
CVE-2025-26597 A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTy ...
CVE-2025-26598 An out-of-bounds write flaw was found in X.Org and Xwayland. The funct ...
CVE-2025-26599 An access to an uninitialized pointer flaw was found in X.Org and Xway ...
CVE-2025-26600 A use-after-free flaw was found in X.Org and Xwayland. When a device i ...
CVE-2025-26601 A use-after-free flaw was found in X.Org and Xwayland. When changing a ...

Version: 2:21.1.13-2ubuntu1.1 2024-10-30 11:07:05 UTC

  xorg-server (2:21.1.13-2ubuntu1.1) oracular-security; urgency=medium

  * SECURITY UPDATE: Heap-based buffer overflow in _XkbSetCompatMap
    - debian/patches/CVE-2024-9632.patch: properly update size in
      xkb/xkb.c.
    - CVE-2024-9632

 -- Marc Deslauriers <email address hidden> Fri, 11 Oct 2024 10:19:39 -0400

CVE-2024-9632 A flaw was found in the X.org server. Due to improperly tracked alloca ...



About   -   Send Feedback to @ubuntu_updates