xorg-x11-server-1.20.11-28.el8_10.2
エラータID: AXSA:2026-803:05
リリース日:
2026/06/19 Friday - 14:09
題名:
xorg-x11-server-1.20.11-28.el8_10.2
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- X.org、および Xwayland には、スタックベースのバッファオーバー
フローの問題があるため、ローカルの攻撃者により、サービス拒否攻撃
(クラッシュの発生)、および特権昇格を可能とする脆弱性が存在します。
(CVE-2026-50256)
- X.org、および Xwayland の miSyncDestroyFence() 関数には、
メモリ領域の解放後利用の問題があるため、ローカルの攻撃者により、
サービス拒否攻撃 (クラッシュの発生)、および特権昇格を可能とする
脆弱性が存在します。(CVE-2026-50257)
- X.org、および Xwayland には、スタックベースのバッファオーバー
フローの問題があるため、ローカルの攻撃者により、サービス拒否攻撃
(クラッシュの発生)、および特権昇格を可能とする脆弱性が存在します。
(CVE-2026-50258)
- X.org、および Xwayland には、スタックベースのバッファオーバー
フローの問題があるため、ローカルの攻撃者により、サービス拒否攻撃
(クラッシュの発生)、および特権昇格を可能とする脆弱性が存在します。
(CVE-2026-50259)
- X.Org、および Xwayland には、メモリ領域の解放後利用の問題が
あるため、ローカルの攻撃者により、サービス拒否攻撃 (クラッシュの
発生)、および特権昇格を可能とする脆弱性が存在します。
(CVE-2026-50260)
- X.Org、および Xwayland の SyncChangeCounter() 関数には、
メモリ領域の解放後利用の問題があるため、ローカルの攻撃者により、
サービス拒否攻撃 (クラッシュの発生)、および特権昇格を可能とする
脆弱性が存在します。(CVE-2026-50261)
- X.Org、および Xwayland の __glXDisp_ChangeDrawableAttributes()
関数には、メモリ領域の範囲外読み取りの問題があるため、ローカルの
攻撃者により、情報の漏洩を可能とする脆弱性が存在します。
(CVE-2026-50262)
- X.Org、および Xwayland の CreateSaverWindow() 関数には、メモリ
領域の解放後利用の問題があるため、ローカルの攻撃者により、情報の
漏洩を可能とする脆弱性が存在します。(CVE-2026-50263)
- X.Org、および Xwayland には、メモリ領域の範囲外書き込みの問題
があるため、ローカルの攻撃者により、サービス拒否攻撃 (クラッシュ
の発生)、および特権昇格を可能とする脆弱性が存在します。
(CVE-2026-50264)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-50256
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50257
A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50258
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50259
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50260
A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50261
A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50262
An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.
An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.
CVE-2026-50263
A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.
A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.
CVE-2026-50264
An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.
An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.
追加情報:
N/A
ダウンロード:
SRPMS
- xorg-x11-server-1.20.11-28.el8_10.2.src.rpm
MD5: fb3352c312487a74a545826e23ca0c07
SHA-256: 488ee8bd685e64a483d83672524f3d3ab7aa7e81ea0c4b0729795afd9f096d41
Size: 6.34 MB
Asianux Server 8 for x86_64
- xorg-x11-server-common-1.20.11-28.el8_10.2.x86_64.rpm
MD5: 9e84018f72f748773c32ba7c99f6160d
SHA-256: e391b4215be9dae4c437d279d66725da186f5bc9577532179dad72e4ff3e0f06
Size: 45.54 kB - xorg-x11-server-devel-1.20.11-28.el8_10.2.i686.rpm
MD5: 83cb553a7993dca1c89a249c068b93de
SHA-256: 92d8da39c740faf9d1dd30f7024bfccd24f870ba2aecfd3cb946a3ae12288d85
Size: 249.73 kB - xorg-x11-server-devel-1.20.11-28.el8_10.2.x86_64.rpm
MD5: db5c1ca2027ca82e2cf6be3499a159be
SHA-256: c90dc9b5543970c58ee0836278116451ca2b1216941998f68eb7000ad43e4e11
Size: 249.71 kB - xorg-x11-server-source-1.20.11-28.el8_10.2.noarch.rpm
MD5: af098ae3ba3ac0e1b1335304e764f08a
SHA-256: c5ab51ac056e3afcc7d2bef286951f57e077d48f56836e25b5048076610f2813
Size: 2.43 MB - xorg-x11-server-Xdmx-1.20.11-28.el8_10.2.x86_64.rpm
MD5: 231ade5bbb4140e8e5bd792af8ea761f
SHA-256: d031c2e42ae89bafaadc6966a6c43be1f080e84f4f29dc05a6e1b4b83796b79a
Size: 906.05 kB - xorg-x11-server-Xephyr-1.20.11-28.el8_10.2.x86_64.rpm
MD5: e08f18d68856b85216688812d31afc78
SHA-256: f6f5c6b7d4ac116f61432c4be6f6d8cb5b516199cf3aade940fdaeb218d00b21
Size: 1.01 MB - xorg-x11-server-Xnest-1.20.11-28.el8_10.2.x86_64.rpm
MD5: 6c9d77c5f0ecc6a5515a4c4b96d49f94
SHA-256: c09192b3440555d1e5f87eacce1172e4e2841baf8e9ec02b0976e926c4a07314
Size: 723.49 kB - xorg-x11-server-Xorg-1.20.11-28.el8_10.2.x86_64.rpm
MD5: ec43f768cf7fccb0a74984a634f0a5fa
SHA-256: c798de5668aec119bf49bdfd7467ede94f4fb38f204b0d46e337ce419d31a3df
Size: 1.50 MB - xorg-x11-server-Xvfb-1.20.11-28.el8_10.2.x86_64.rpm
MD5: 61546e1d3f78cc05e639bd9dade917b0
SHA-256: 03c5b391103b0f1a17ab0156885a27635393b82e1243263f153dcca5ad39e372
Size: 876.97 kB
English