[Git][security-tracker-team/security-tracker][master] Track fixed version for xwayland issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Oct 7 12:15:27 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3b875428 by Salvatore Bonaccorso at 2026-10-07T13:15:03+02:00
Track fixed version for xwayland issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -584,73 +584,73 @@ CVE-2026-101023 (Gitea's OAuth2 token endpoint verified the signature and grant
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
CVE-2026-88812 [XKB SetGeometry TextDoodad Double Free]
- xorg-server <unfixed> (bug #1150214)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09 (xorg-server-21.1.25)
CVE-2026-93515 [Present Extension Cross-Window Notify Use-After-Free]
- xorg-server <unfixed> (bug #1150214)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/a469f98bcfab50dab607ff5ac24037632b0079a3 (xorg-server-21.1.25)
CVE-2026-93516 [XInput Passive Grab modifierDevice Use-After-Free]
- xorg-server <unfixed> (bug #1150214)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9442a53c137bb9eb61336c6fd39627912d50cc8d (xorg-server-21.1.25)
CVE-2026-93517 [GLX RenderLarge Heap Buffer Overflow]
- xorg-server <unfixed> (bug #1150214)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/3961cdca467975a7d377f1f7bcd55d52eb3f417a (xorg-server-21.1.25)
CVE-2026-93518 [XKB ResizeKeyType Numeric Truncation]
- xorg-server <unfixed> (bug #1150214)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/558ba8f784b0f5d4d96948051b2f04c983af20cc (xorg-server-21.1.25)
CVE-2026-93519 [XFixes Pointer Barrier Event List Buffer Overflow]
- xorg-server <unfixed> (bug #1150214)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9c3880d0745acefc98ed37e79498dfbe558a0f40 (xorg-server-21.1.25)
CVE-2026-93520 [XKB ChangeKeycodeRange Heap Out-of-Bounds Write]
- xorg-server <unfixed> (bug #1150214)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5ec0535af2bcc93381666dc110abebba8975f8ae (xorg-server-21.1.25)
CVE-2026-93521 [RandR ChangeProviderProperty Heap Buffer Overflow]
- xorg-server <unfixed> (bug #1150214)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/00ce692c7f6ea1900888a2a24aecf6cba5544ae1 (xorg-server-21.1.25)
CVE-2026-93522 [Glamor CopyArea CPU-FBO Heap Buffer Overflow]
- xorg-server <not-affected> (Vulnerable code not present)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/d6deb27b655abae79396bf3aedc2937a10ae2d4f (xwayland-24.1.14)
CVE-2026-93523 [XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write]
- xorg-server <unfixed> (bug #1150214)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/aa56160fa213d8767e7da0c076b5c8242703313b (xorg-server-21.1.25)
CVE-2026-93524 [XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read]
- xorg-server <unfixed> (bug #1150214)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/927ee1282d21550807619521bee909ef62ed0571 (xorg-server-21.1.25)
CVE-2026-93536 [GestureBuildSprite Use-After-Free]
- xorg-server <unfixed> (bug #1150214)
- - xwayland <unfixed> (bug #1150213; unimportant)
+ - xwayland 2:24.1.14-1 (bug #1150213; unimportant)
NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/4c9c345d2a10baf956fdefa83bb88681f7c840cf (xorg-server-21.1.25)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3b875428812db1096bbe62a03f47499a6f7e4755
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3b875428812db1096bbe62a03f47499a6f7e4755
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/96e5a530/attachment.htm>
More information about the debian-security-tracker-commits
mailing list