Xorg Xwayland
By the Year
In 2024 there have been 3 vulnerabilities in Xorg Xwayland with an average score of 7.7 out of ten. Last year Xwayland had 3 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Xwayland in 2024 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2024 is greater by 1.20.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2024 | 3 | 7.70 |
| 2023 | 3 | 6.50 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Xwayland vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Xorg Xwayland Security Vulnerabilities
A flaw was found in the X.Org server
CVE-2024-0409
7.8 - High
- January 18, 2024
A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
Memory Corruption
A flaw was found in the X.Org server
CVE-2024-0408
5.5 - Medium
- January 18, 2024
A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.
A flaw was found in X.Org server
CVE-2023-6816
9.8 - Critical
- January 18, 2024
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.
Memory Corruption
A use-after-free flaw was found in xorg-x11-server-Xvfb
CVE-2023-5574
7 - High
- October 25, 2023
A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a screen 0, a use-after-free issue may be triggered during shutdown or reset of the Xvfb server, allowing for possible escalation of privileges or denial of service.
Dangling pointer
A use-after-free flaw was found in the xorg-x11-server
CVE-2023-5380
4.7 - Medium
- October 25, 2023
A use-after-free flaw was found in the xorg-x11-server. An X server crash may occur in a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode) if the pointer is warped from within a window on one screen to the root window of the other screen and if the original window is destroyed followed by another window being destroyed.
Dangling pointer
A out-of-bounds write flaw was found in the xorg-x11-server
CVE-2023-5367
7.8 - High
- October 25, 2023
A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty function in randr/rrproperty.c, allowing for possible escalation of privileges or denial of service.
Memory Corruption
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Red Hat Enterprise Linux Ibm Z Systems or by Xorg? Click the Watch button to subscribe.
