[Git][security-tracker-team/security-tracker][master] Add new xorg-server and xwayland issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Oct 7 06:51:59 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
012f4f66 by Salvatore Bonaccorso at 2026-10-07T07:51:36+02:00
Add new xorg-server and xwayland issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,87 @@
+CVE-2026-88812 [XKB SetGeometry TextDoodad Double Free]
+ - xorg-server <unfixed>
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09 (xorg-server-21.1.25)
+CVE-2026-93515 [Present Extension Cross-Window Notify Use-After-Free]
+ - xorg-server <unfixed>
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/a469f98bcfab50dab607ff5ac24037632b0079a3 (xorg-server-21.1.25)
+CVE-2026-93516 [XInput Passive Grab modifierDevice Use-After-Free]
+ - xorg-server <unfixed>
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9442a53c137bb9eb61336c6fd39627912d50cc8d (xorg-server-21.1.25)
+CVE-2026-93517 [GLX RenderLarge Heap Buffer Overflow]
+ - xorg-server <unfixed>
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/3961cdca467975a7d377f1f7bcd55d52eb3f417a (xorg-server-21.1.25)
+CVE-2026-93518 [XKB ResizeKeyType Numeric Truncation]
+ - xorg-server <unfixed>
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/558ba8f784b0f5d4d96948051b2f04c983af20cc (xorg-server-21.1.25)
+CVE-2026-93519 [XFixes Pointer Barrier Event List Buffer Overflow]
+ - xorg-server <unfixed>
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9c3880d0745acefc98ed37e79498dfbe558a0f40 (xorg-server-21.1.25)
+CVE-2026-93520 [XKB ChangeKeycodeRange Heap Out-of-Bounds Write]
+ - xorg-server <unfixed>
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5ec0535af2bcc93381666dc110abebba8975f8ae (xorg-server-21.1.25)
+CVE-2026-93521 [RandR ChangeProviderProperty Heap Buffer Overflow]
+ - xorg-server <unfixed>
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/00ce692c7f6ea1900888a2a24aecf6cba5544ae1 (xorg-server-21.1.25)
+CVE-2026-93522 [Glamor CopyArea CPU-FBO Heap Buffer Overflow]
+ - xorg-server <not-affected> (Vulnerable code not present)
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/d6deb27b655abae79396bf3aedc2937a10ae2d4f (xwayland-24.1.14)
+CVE-2026-93523 [XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write]
+ - xorg-server <unfixed>
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/aa56160fa213d8767e7da0c076b5c8242703313b (xorg-server-21.1.25)
+CVE-2026-93524 [XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read]
+ - xorg-server <unfixed>
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/927ee1282d21550807619521bee909ef62ed0571 (xorg-server-21.1.25)
+CVE-2026-93536 [GestureBuildSprite Use-After-Free]
+ - xorg-server <unfixed>
+ - xwayland <unfixed>
+ [trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ [bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be running as root)
+ NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
+ NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/4c9c345d2a10baf956fdefa83bb88681f7c840cf (xorg-server-21.1.25)
CVE-2026-9226 (Authentication bypass in the Azure AD external login flow in Devolutio ...)
NOT-FOR-US: Devolutions
CVE-2026-97308 (Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 version ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/012f4f66d949c000a7516ca8d39a83431c44aa65
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/012f4f66d949c000a7516ca8d39a83431c44aa65
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/74dfcd26/attachment.htm>
More information about the debian-security-tracker-commits
mailing list