Multiple vulnerabilities have been found in X.Org X server, XWayland.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 21.1.24 | >= 21.1.24 |
| x11-base/xwayland | * | < 24.1.13 | >= 24.1.13 |
The X Window System is a graphical windowing system based on a client/server model.
Multiple vulnerabilities have been discovered in X.Org X server, XWayland. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All X.Org X server, XWayland users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-21.1.24"
All X.Org X server, XWayland users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xwayland-24.1.13"
A vulnerability has been discovered in the Xorg Server and XWayland, the worst of which can result in privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 21.1.16 | >= 21.1.16 |
| x11-base/xwayland | * | < 24.1.6 | >= 24.1.6 |
The X Window System is a graphical windowing system based on a client/server model.
Multiple vulnerabilities have been discovered in X.Org X server and XWayland. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All X.Org X server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-21.1.16"
All XWayland users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xwayland-24.1.6"
A vulnerability has been discovered in the Xorg Server and XWayland, the worst of which can result in privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 21.1.14 | >= 21.1.14 |
| x11-base/xwayland | * | < 24.1.4 | >= 24.1.4 |
The X Window System is a graphical windowing system based on a client/server model.
Multiple vulnerabilities have been discovered in X.Org X server and XWayland. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All X.Org X server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-21.1.14"
All XWayland users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xwayland-24.1.4"
Multiple vulnerabilities have been discovered in the Xorg Server and XWayland, the worst of which can result in privilege escalation or remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 21.1.11 | >= 21.1.11 |
| x11-base/xwayland | * | < 23.2.4 | >= 23.2.4 |
The X Window System is a graphical windowing system based on a client/server model.
Multiple vulnerabilities have been discovered in X.Org X Server and XWayland. Please review the CVE identifiers referenced below for details.
The X server can be crashed by a malicious client, or potentially be compromised for remote code execution in environments with X11 forwarding.
Users can ensure no untrusted clients can access the running X implementation.
All X.Org X Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-21.1.11"
All XWayland users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xwayland-23.2.4"
Multiple vulnerabilities have been discovered in the Xorg Server and XWayland, the worst of which can result in privilege escalation or remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 21.1.8 | >= 21.1.8 |
| x11-base/xwayland | * | < 23.1.1 | >= 23.1.1 |
The X Window System is a graphical windowing system based on a client/server model.
Multiple vulnerabilities have been discovered in X.Org X server, XWayland. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All X.Org X server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-21.1.8"
All XWayland users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xwayland-23.1.1"
Multiple vulnerabilities have been discovered in the Xorg Server and XWayland, the worst of which can result in remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 21.1.4 | >= 21.1.4 |
| x11-base/xwayland | * | < 22.1.3 | >= 22.1.3 |
The X Window System is a graphical windowing system based on a client/server model.
Multiple vulnerabilities have been discovered in X.Org X server and XWayland. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All X.Org X server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-21.1.4"
All XWayland users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xwayland-22.1.3"
A vulnerability in X.Org X Server may allow users to escalate privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.20.11 | >= 1.20.11 |
The X Window System is a graphical windowing system based on a client/server model.
It was discovered that X.Org X Server did not sufficiently check the length of the XInput extension’s ChangeFeedbackControl request.
An authorized attacker could possibly escalate privileges, or cause a Denial of Service condition.
There is no known workaround at this time.
All X.Org X Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.20.11"
Multiple vulnerabilities have been found in X.org X Server, the worst of which could lead to privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.20.10 | >= 1.20.10 |
The X Window System is a graphical windowing system based on a client/server model.
Multiple vulnerabilities have been discovered in X.org X Server. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
A local attacker could escalate privileges.
All X.org X Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=11-base/xorg-server-1.20.10"
A vulnerability in X.Org X Server allows local users to escalate privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.20.3 | >= 1.20.3 |
The X Window System is a graphical windowing system based on a client/server model.
An incorrect permission check for -modulepath and -logfile options when starting Xorg. X server allows unprivileged users with the ability to log in to the system via physical console to escalate their privileges and run arbitrary code under root privileges.
A local attacker can escalate privileges to root by passing crafted parameters to the X.org X server.
There is no known workaround at this time.
All X.Org X Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.20.3"
Multiple vulnerabilities have been found in X.Org Server, the worst of which could allow an attacker to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.19.5 | >= 1.19.5 |
The X.Org project provides an open source implementation of the X Window System.
Multiple vulnerabilities have been discovered in X.Org Server. Please review the referenced CVE identifiers for details.
Attackers could execute arbitrary code or cause a Denial of Service condition.
There is now know workaround at this time.
All X.Org Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.19.5"
Multiple vulnerabilities have been found in X.Org Server the worst of which could allow a local attacker to replace shared memory segments.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.19.4 | >= 1.19.4 |
The X.Org project provides an open source implementation of the X Window System.
Multiple vulnerabilities have been discovered in X.Org Server. Please review the referenced CVE identifiers for details.
A local attacker could cause a global buffer overflow or a Denial of Service condition.
There is no known workaround at this time
All X.Org Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.19.4"
Multiple vulnerabilities have been found in X.Org server and libraries, the worse of which allowing local attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.19.2 | >= 1.19.2 |
| x11-libs/libICE | * | < 1.0.9-r1 | >= 1.0.9-r1 |
| x11-libs/libXdmcp | * | < 1.1.2-r1 | >= 1.1.2-r1 |
| x11-libs/libXfixes | * | < 5.0.3 | >= 5.0.3 |
| x11-libs/libXi | * | < 1.7.7 | >= 1.7.7 |
| x11-libs/libXrandr | * | < 1.5.1 | >= 1.5.1 |
| x11-libs/libXrender | * | < 0.9.10 | >= 0.9.10 |
| x11-libs/libXv | * | < 1.0.11 | >= 1.0.11 |
X.Org X servers
Multiple vulnerabilities have been discovered in X.Org server and libraries. Please review the CVE identifiers referenced below for details.
A local or remote users can utilize the vulnerabilities to attach to the X.Org session as a user and execute arbitrary code.
There is no known workaround at this time.
All X.Org-server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.19.2"
All libICE users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/libICE-1.0.9-r1"
All libXdmcp users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/libXdmcp-1.1.2-r1"
All libXrender users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/libXrender-0.9.10"
All libXi users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/libXi-1.7.7"
All libXrandr users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/libXrandr-1.5.1"
All libXfixes users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/libXfixes-5.0.3"
All libXv users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/libXv-1.0.11"
Multiple vulnerabilities have been found in X.Org X Server, the worst of which may allow authenticated attackers to read from or send information to arbitrary X11 clients.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.18.4 | >= 1.18.4 |
The X Window System is a graphical windowing system based on a client/server model.
Multiple vulnerabilities have been discovered in X.Org X Server. Please review the CVE identifiers referenced below for details.
An authenticated attacker could possibly cause a Denial of Service condition or read from or send information to arbitrary X11 clients.
There is no known workaround at this time.
All X.Org X Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.18.4"
Multiple vulnerabilities have been found in X.Org X Server, allowing attackers to execute arbitrary code or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.12.4-r4 | >= 1.12.4-r4 |
The X Window System is a graphical windowing system based on a client/server model.
Multiple vulnerabilities have been discovered in X.Org X Server. Please review the CVE identifiers referenced below for details.
A remote attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition.
There is no known workaround at this time.
All X.Org X Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.12.4-r4"
Multiple vulnerabilities have been found in X.Org X Server, allowing attackers to execute arbitrary code or cause a Denial of Service condition.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.14.3-r2 | >= 1.14.3-r2 |
The X Window System is a graphical windowing system based on a client/server model.
Multiple vulnerabilities have been discovered in X.Org X Server. Please review the CVE identifiers referenced below for details.
A context-dependent attacker could execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or obtain sensitive information.
There is no known workaround at this time.
All X.Org X Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.14.3-r2"
A format string vulnerability in X.Org X Server may allow local privilege escalation or Denial of Service.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.11.4-r1 | >= 1.11.4-r1, >= 1.10.6-r1 (revision), <= 1.9.5-r1 (revision) |
The X Window System is a graphical windowing system based on a client/server model.
The "LogVHdrMessageVerb()" function in log.c contains a format string vulnerability.
NOTE: Exposure to this vulnerability is reduced in Gentoo due to X.Org X Server being built with "-D_FORTIFY_SOURCE=2" by default.
A local attacker could gain escalated privileges or cause a Denial of Service condition.
There is no known workaround at this time.
All X.Org X Server 1.11.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.11.4-r1"
All X.Org X Server 1.10.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.10.6-r1"
X.Org X Server 1.9.x is not affected.
Multiple vulnerabilities in the X.Org X server might allow local attackers to disclose information.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.10.4-r1 | >= 1.9.5-r1 (revision), >= 1.10.4-r1 |
The X Window System is a graphical windowing system based on a client/server model.
vladz reported the following vulnerabilities in the X.Org X server:
A local attacker could exploit these vulnerabilities to disclose information by making arbitrary files on a system world-readable or gain information whether a specified file exists on the system and whether it is a file, directory, or a named pipe.
There is no known workaround at this time.
All X.Org X Server 1.9 users should upgrade to the latest 1.9 version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.9.5-r1"
All X.Org X Server 1.10 users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.10.4-r1"
Multiple vulnerabilities have been discovered in the X.Org X server, possibly allowing for the remote execution of arbitrary code with root privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.3.0.0-r6 | >= 1.3.0.0-r6 |
The X Window System is a graphical windowing system based on a client/server model.
Regenrecht reported multiple vulnerabilities in various X server extensions via iDefense:
Exploitation of these vulnerabilities could possibly lead to the remote execution of arbitrary code with root privileges, if the server is running as root, which is the default. It is also possible to crash the server by making use of these vulnerabilities.
It is possible to avoid these vulnerabilities by disabling the affected server extensions. Therefore edit the configuration file (/etc/X11/xorg.conf) to contain the following in the appropriate places:
Section "Extensions" Option "MIT-SHM" "disable" Option "RENDER" "disable" Option "SECURITY" "disable" EndSection Section "Module" Disable "record" EndSection
All X.org X Server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.3.0.0-r6"
Multiple vulnerabilities have been discovered in the X.Org X server and Xfont library, allowing for a local privilege escalation and arbitrary code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.3.0.0-r5 | >= 1.3.0.0-r5 |
| x11-libs/libXfont | * | < 1.3.1-r1 | >= 1.3.1-r1 |
The X Window System is a graphical windowing system based on a client/server model.
regenrecht reported multiple vulnerabilities in various X server extension via iDefense:
Remote attackers could exploit the vulnerability in the Xfont library by enticing a user to load a specially crafted PCF font file resulting in the execution of arbitrary code with the privileges of the user running the X server, typically root. Local attackers could exploit this and the vulnerabilities in the X.org extensions to gain elevated privileges. If the X server allows connections from the network, these vulnerabilities could be exploited remotely. A local attacker could determine the existence of arbitrary files by exploiting the last vulnerability or possibly cause a Denial of Service.
Workarounds for some of the vulnerabilities can be found in the X.Org security advisory as listed under References.
All X.Org X server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.3.0.0-r5"
All X.Org Xfont library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/libXfont-1.3.1-r1"
A vulnerability has been discovered in the Composite extension of the X.Org X server, allowing for a local privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.3.0.0-r1 | >= 1.3.0.0-r1 |
The X Window System is a graphical windowing system based on a client/server model.
Aaron Plattner discovered a buffer overflow in the compNewPixmap() function when copying data from a large pixel depth pixmap into a smaller pixel depth pixmap.
A local attacker could execute arbitrary code with the privileges of the user running the X server, typically root.
Disable the Composite extension by setting ' Option "Composite" "disable" ' in the Extensions section of xorg.conf.
Note: This could affect the functionality of some applications.
All X.Org X server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.3.0.0-r1"
Sean Larsson from iDefense Labs has found multiple vulnerabilities in the DBE and Render extensions.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| x11-base/xorg-server | * | < 1.1.1-r4 | >= 1.1.1-r4 |
The X Window System is a graphical windowing system based on a client/server model.
Multiple memory corruption vulnerabilities have been found in the ProcDbeGetVisualInfo() and the ProcDbeSwapBuffers() of the DBE extension, and ProcRenderAddGlyphs() in the Render extension.
A local attacker could execute arbitrary code with the privileges of the user running the X server, typically root.
Disable the DBE extension by removing the "Load dbe" directive in the Module section of xorg.conf, and explicitly disable the Render extension with ' Option "RENDER" "disable" ' in the Extensions section.
Note: This could affect the functionality of some applications.
All X.Org X server users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.1.1-r4"
X.org, libX11, xdm, xf86dga, xinit, xload, xtrans, and xterm are vulnerable to local privilege escalations because of unchecked setuid() calls.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-emulation/emul-linux-x86-xlibs | amd64 | < 7.0-r2 | >= 7.0-r2 |
| x11-apps/xdm | * | < 1.0.4-r1 | >= 1.0.4-r1 |
| x11-apps/xf86dga | * | < 1.0.1-r1 | >= 1.0.1-r1 |
| x11-apps/xinit | * | < 1.0.2-r6 | >= 1.0.2-r6 |
| x11-apps/xload | * | < 1.0.1-r1 | >= 1.0.1-r1 |
| x11-base/xorg-server | * | < 1.1.0-r1 | >= 1.0.2-r6 (revision), >= 1.1.0-r1 |
| x11-base/xorg-x11 | * | < 6.9.0-r2 | >= 6.8.2-r8 (revision), >= 6.9.0-r2 |
| x11-libs/libx11 | * | < 1.0.1-r1 | >= 1.0.1-r1 |
| x11-libs/xtrans | * | < 1.0.0-r1 | >= 1.0.0-r1 |
| x11-terms/xterm | * | < 215 | >= 215 |
X.org is an implementation of the X Window System.
Several X.org libraries and X.org itself contain system calls to set*uid() functions, without checking their result.
Local users could deliberately exceed their assigned resource limits and elevate their privileges after an unsuccessful set*uid() system call. This requires resource limits to be enabled on the machine.
There is no known workaround at this time.
All X.Org xdm users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-apps/xdm-1.0.4-r1"
All X.Org xinit users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-apps/xinit-1.0.2-r6"
All X.Org xload users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-apps/xload-1.0.1-r1"
All X.Org xf86dga users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-apps/xf86dga-1.0.1-r1"
All X.Org users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-x11-6.9.0-r2"
All X.Org X servers users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-base/xorg-server-1.1.0-r1"
All X.Org X11 library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/libx11-1.0.1-r1"
All X.Org xtrans library users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-libs/xtrans-1.0.1-r1"
All xterm users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=x11-terms/xterm-215"
All users of the X11R6 libraries for emulation of 32bit x86 on amd64 should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-emulation/emul-linux-x86-xlibs-7.0-r2"
Please note that the fixed packages have been available for most architectures since June 30th but the GLSA release was held up waiting for the remaining architectures.