-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4737-1 [email protected]
https://www.debian.org/lts/security/ Arnaud Rebillout
August 13, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : xorg-server
Version : 2:21.1.7-3+deb12u13
CVE ID : CVE-2022-49737 CVE-2026-50256 CVE-2026-50257 CVE-2026-50258
CVE-2026-50259 CVE-2026-50260 CVE-2026-50261 CVE-2026-50262
CVE-2026-50263 CVE-2026-50264
Debian Bug : 1081338 1138680
Several vulnerabilities were discovered in the Xorg X server, which may
result in privilege escalation if the X server is running privileged.
CVE-2022-49737
In X.Org X server 20.11 through 21.1.16, when a client application
uses easystroke for mouse gestures, the main thread modifies various
data structures used by the input thread without acquiring a lock,
aka a race condition. In particular, AttachDevice in dix/devices.c
does not acquire an input lock.
CVE-2026-50256
A stack-based buffer overflow flaw was found in the X.Org X server
and Xwayland. A mismatch between the X server and the libXfont2
library's maximum font name length can cause a stack buffer overflow
during font alias resolution. The server allocates a 256 byte stack
buffer but libXfont2's alias target name length is 1024 bytes. A font
alias name between 257 and 1023 bytes causes the X server to copy
that name into the undersized stack buffer without further checks.
This may be used to crash the server, or for privilege escalation if
the X server runs as root.
CVE-2026-50257
A use-after-free flaw was found in the X.Org X server and Xwayland in
miSyncDestroyFence(). A client that sets up multiple fence triggers
can trigger a use-after-free function pointer call. An attacker would
connect to the X server to set up a fence and await that fence, then
a second X connection destroys the fence, causing the use-after-free.
This may be used to crash the server, or for privilege escalation if
the X server runs as root.
CVE-2026-50258
A stack-based buffer overflow flaw was found in the X.Org X server
and Xwayland. The X server has multiple stack buffers sized
XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not
verify or clamp non-canonical key types to XkbMaxShiftLevel. A client
can change key types to excessive shift levels and trigger stack
overflows. This is caused by an incomplete fix of CVE-2025-26597.
This may be used to crash the server, or for privilege escalation if
the X server runs as root.
CVE-2026-50259
A stack-based buffer overflow flaw was found in the X.Org X server
and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer
mapWidths[256] indexed by key type index. The helper function
CheckKeyTypes() writes to this buffer at a client-controlled offset,
allowing a stack buffer overflow. This may be used to crash the
server, or for privilege escalation if the X server runs as root.
CVE-2026-50260
A use-after-free flaw was found in the X.Org X server and Xwayland in
FreeCounter(). A client that sets up multiple SyncCounters and awaits
on those triggers can trigger a use-after-free when destroying those
counters via a second client connection. This may be used to crash
the server, or for privilege escalation if the X server runs as root.
CVE-2026-50261
A use-after-free flaw was found in the X.Org X server and Xwayland in
SyncChangeCounter(). A client that sets up multiple SyncCounters can
trigger a use-after-free when destroying those counters via a second
client connection while changing those counters. This may be used to
crash the server, or for privilege escalation if the X server runs as
root.
CVE-2026-50262
An out-of-bounds read flaw was found in the X.Org X server and
Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size
validation check can read a client-controlled number of bytes,
exceeding the request buffer, leading to information disclosure. A
write path also exists but requires byte-swapped clients which is
disabled by default.
CVE-2026-50263
A use-after-free flaw was found in the X.Org X server and Xwayland in
CreateSaverWindow(). A client can trigger a use-after-free read after
changing window attributes and forcing the screen saver, leading to
information disclosure.
CVE-2026-50264
An out-of-bounds write flaw was found in the X.Org X server and
Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that
requests multiple DRI2BufferBackLeft attachments and one
DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may
be used to crash the server, or for privilege escalation if the X
server runs as root.
For Debian 12 bookworm, these problems have been fixed in version
2:21.1.7-3+deb12u13.
We recommend that you upgrade your xorg-server packages.
For the detailed security status of xorg-server please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/xorg-server
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE0Kl7ndbut+9n4bYs5yXoeRRgAhYFAmp9TzoACgkQ5yXoeRRg
AhY9NA//WXfeABflCzqU572GTFtyzXl4xoXMDdPcew6hHytJ1v29ctQR+WBwVe27
rpr1FoswXKzrdrOI2kxgvJb2ZGyCNvpfiQWYaPJ/GHw+GZPZAjAUuOGOqsGxkOtC
XCUxpREAec7mLKmZUx4IW3RcGM/JjjqapbTrYDXdTe0l2iRQqkjAJ5xvtoYb56EW
XIQ1XVPqpozR4oNlecV6AuzXQlCki6egQBQsgKF02cF3E7ZKIdzkRL/KOPGom7Wi
NTpCcXafDz0lQhCFepjoFgVbvTlhPG+wGoKeAzj0MoefAIz5Ffmsw1wUEffrmS6w
r9JVcuPUw9fBStk2U70eqBD7LayXRaAzTJ00U3h/HtIOr0R+hgMfJ6uByRHHKulD
15M3/KRFcQztRYg5wuvfu0xT/AG7cT/FxMo4o0eHeg20LoeGlUpnIqHSC5O1kxaY
TkTIzKCJqrk0Y8eCi5uLBu7Uihp69pb/iSXZmKZSl8nTqO0jhnEf5cy66VFfZvaz
jaCW4GedreEnhYepXRfEotu1jQ9Gq4nl7QGSfWMEqsJ0abgb2lxPRbnXR3vBfM/k
APxKb8gOcGLgJHednvHWTLtVz2soG5dwiAw2f0RIw5I+MiGULajJ3H5lNDLWzU/U
OOYGKSHWdU5nGbtjug9l5zkwSC6s/AUihvaqjTkwwk5a8XokpsQ=
=Anih
-----END PGP SIGNATURE-----
