[Git][security-tracker-team/security-tracker][master] Track fixed version for xorg-server issues fixed via unstable upload

Salvatore Bonaccorso (@carnil) carnil at debian.org
Wed Oct 7 12:17:33 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5c49d227 by Salvatore Bonaccorso at 2026-10-07T13:17:00+02:00
Track fixed version for xorg-server issues fixed via unstable upload

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -583,49 +583,49 @@ CVE-2026-101027 (When `[migrations] ALLOWED_DOMAINS` was configured, a hostname
 CVE-2026-101023 (Gitea's OAuth2 token endpoint verified the signature and grant of a to ...)
 	NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
 CVE-2026-88812 [XKB SetGeometry TextDoodad Double Free]
-	- xorg-server <unfixed> (bug #1150214)
+	- xorg-server 2:21.1.25-1 (bug #1150214)
 	- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
 	NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09 (xorg-server-21.1.25)
 CVE-2026-93515 [Present Extension Cross-Window Notify Use-After-Free]
-	- xorg-server <unfixed> (bug #1150214)
+	- xorg-server 2:21.1.25-1 (bug #1150214)
 	- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
 	NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/a469f98bcfab50dab607ff5ac24037632b0079a3 (xorg-server-21.1.25)
 CVE-2026-93516 [XInput Passive Grab modifierDevice Use-After-Free]
-	- xorg-server <unfixed> (bug #1150214)
+	- xorg-server 2:21.1.25-1 (bug #1150214)
 	- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
 	NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9442a53c137bb9eb61336c6fd39627912d50cc8d (xorg-server-21.1.25)
 CVE-2026-93517 [GLX RenderLarge Heap Buffer Overflow]
-	- xorg-server <unfixed> (bug #1150214)
+	- xorg-server 2:21.1.25-1 (bug #1150214)
 	- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
 	NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/3961cdca467975a7d377f1f7bcd55d52eb3f417a (xorg-server-21.1.25)
 CVE-2026-93518 [XKB ResizeKeyType Numeric Truncation]
-	- xorg-server <unfixed> (bug #1150214)
+	- xorg-server 2:21.1.25-1 (bug #1150214)
 	- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
 	NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/558ba8f784b0f5d4d96948051b2f04c983af20cc (xorg-server-21.1.25)
 CVE-2026-93519 [XFixes Pointer Barrier Event List Buffer Overflow]
-	- xorg-server <unfixed> (bug #1150214)
+	- xorg-server 2:21.1.25-1 (bug #1150214)
 	- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
 	NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/9c3880d0745acefc98ed37e79498dfbe558a0f40 (xorg-server-21.1.25)
 CVE-2026-93520 [XKB ChangeKeycodeRange Heap Out-of-Bounds Write]
-	- xorg-server <unfixed> (bug #1150214)
+	- xorg-server 2:21.1.25-1 (bug #1150214)
 	- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
 	NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/5ec0535af2bcc93381666dc110abebba8975f8ae (xorg-server-21.1.25)
 CVE-2026-93521 [RandR ChangeProviderProperty Heap Buffer Overflow]
-	- xorg-server <unfixed> (bug #1150214)
+	- xorg-server 2:21.1.25-1 (bug #1150214)
 	- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
 	NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
@@ -637,19 +637,19 @@ CVE-2026-93522 [Glamor CopyArea CPU-FBO Heap Buffer Overflow]
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/d6deb27b655abae79396bf3aedc2937a10ae2d4f (xwayland-24.1.14)
 CVE-2026-93523 [XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write]
-	- xorg-server <unfixed> (bug #1150214)
+	- xorg-server 2:21.1.25-1 (bug #1150214)
 	- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
 	NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/aa56160fa213d8767e7da0c076b5c8242703313b (xorg-server-21.1.25)
 CVE-2026-93524 [XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read]
-	- xorg-server <unfixed> (bug #1150214)
+	- xorg-server 2:21.1.25-1 (bug #1150214)
 	- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
 	NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html
 	NOTE: Fixed by: https://gitlab.freedesktop.org/xorg/xserver/-/commit/927ee1282d21550807619521bee909ef62ed0571 (xorg-server-21.1.25)
 CVE-2026-93536 [GestureBuildSprite Use-After-Free]
-	- xorg-server <unfixed> (bug #1150214)
+	- xorg-server 2:21.1.25-1 (bug #1150214)
 	- xwayland 2:24.1.14-1 (bug #1150213; unimportant)
 	NOTE: Xwayland shouldn't be running as root, cf. README.Debian.security
 	NOTE: https://lists.x.org/archives/xorg-announce/2026-October/003747.html



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c49d227c62c2c85c8c8086635901d2e5a786fd0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c49d227c62c2c85c8c8086635901d2e5a786fd0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/4082ff24/attachment.htm>

More information about the debian-security-tracker-commits mailing list