tigervnc-1.15.0-10.el8_10
エラータID: AXSA:2026-1140:04
リリース日:
2026/07/01 Wednesday - 11:19
題名:
tigervnc-1.15.0-10.el8_10
影響のあるチャネル:
Asianux Server 8 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- X.org、および Xwayland には、スタックベースのバッファオーバー
フローの問題があるため、ローカルの攻撃者により、サービス拒否攻撃
(クラッシュの発生)、および特権昇格を可能とする脆弱性が存在します。
(CVE-2026-50256)
- X.org、および Xwayland の miSyncDestroyFence() 関数には、
メモリ領域の解放後利用の問題があるため、ローカルの攻撃者により、
サービス拒否攻撃 (クラッシュの発生)、および特権昇格を可能とする
脆弱性が存在します。(CVE-2026-50257)
- X.org、および Xwayland には、スタックベースのバッファオーバー
フローの問題があるため、ローカルの攻撃者により、サービス拒否攻撃
(クラッシュの発生)、および特権昇格を可能とする脆弱性が存在します。
(CVE-2026-50258)
- X.org、および Xwayland には、スタックベースのバッファオーバー
フローの問題があるため、ローカルの攻撃者により、サービス拒否攻撃
(クラッシュの発生)、および特権昇格を可能とする脆弱性が存在します。
(CVE-2026-50259)
- X.Org、および Xwayland には、メモリ領域の解放後利用の問題が
あるため、ローカルの攻撃者により、サービス拒否攻撃 (クラッシュの
発生)、および特権昇格を可能とする脆弱性が存在します。
(CVE-2026-50260)
- X.Org、および Xwayland の SyncChangeCounter() 関数には、
メモリ領域の解放後利用の問題があるため、ローカルの攻撃者により、
サービス拒否攻撃 (クラッシュの発生)、および特権昇格を可能とする
脆弱性が存在します。(CVE-2026-50261)
- X.Org、および Xwayland の __glXDisp_ChangeDrawableAttributes()
関数には、メモリ領域の範囲外読み取りの問題があるため、ローカルの
攻撃者により、情報の漏洩を可能とする脆弱性が存在します。
(CVE-2026-50262)
- X.Org、および Xwayland の CreateSaverWindow() 関数には、メモリ
領域の解放後利用の問題があるため、ローカルの攻撃者により、情報の
漏洩を可能とする脆弱性が存在します。(CVE-2026-50263)
- X.Org、および Xwayland には、メモリ領域の範囲外書き込みの問題
があるため、ローカルの攻撃者により、サービス拒否攻撃 (クラッシュ
の発生)、および特権昇格を可能とする脆弱性が存在します。
(CVE-2026-50264)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-50256
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50257
A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50258
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50259
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50260
A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50261
A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.
A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.
CVE-2026-50262
An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.
An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.
CVE-2026-50263
A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.
A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.
CVE-2026-50264
An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.
An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.
追加情報:
N/A
ダウンロード:
SRPMS
- tigervnc-1.15.0-10.el8_10.src.rpm
MD5: 85356f51366037cee34a2211d5b2d05c
SHA-256: 19d7eae9d0eb88ef029b9ce71b79f9168caf65cd8fdb086045e0d555a291e628
Size: 2.11 MB
Asianux Server 8 for x86_64
- tigervnc-1.15.0-10.el8_10.x86_64.rpm
MD5: e91bf7a9641f844683a930c053c23881
SHA-256: 15a987069cbee99a52dce2ec4317b4d86f841c0063e89c6e9146b19610ad95dc
Size: 407.95 kB - tigervnc-icons-1.15.0-10.el8_10.noarch.rpm
MD5: d4e6585c2ca78c98c9233047e6461256
SHA-256: 4e572ef9c1ea7f1dfa709e764a34f3374ac5ff8ee030b483a801a08558dcb866
Size: 64.63 kB - tigervnc-license-1.15.0-10.el8_10.noarch.rpm
MD5: afcf5a402f67f3ae240effcd550440b2
SHA-256: f37d8df27959c1a99a3597bc041880316b8b211e6d544d45c7edf9ed09d243dd
Size: 45.01 kB - tigervnc-selinux-1.15.0-10.el8_10.noarch.rpm
MD5: 00e4370b5a78619660a32fa5df56de5f
SHA-256: 01470bc32eb09ec64dec3860812f3d77516bdc7c7438a3371406b1e48adb4381
Size: 54.24 kB - tigervnc-server-1.15.0-10.el8_10.x86_64.rpm
MD5: 8f1fa29282168d798c26351803aea87a
SHA-256: e0f2c35c0fe4036039e29052449ca570d23e38e9bba5ca2fcf55e34f984f8ac2
Size: 316.09 kB - tigervnc-server-minimal-1.15.0-10.el8_10.x86_64.rpm
MD5: bd320ffcd3f2a57411d95e77132d86f2
SHA-256: b50bf9d08c62fe73136f9df72d5d80c0ff11ff39ce237df1d4c9054af6abf612
Size: 1.18 MB - tigervnc-server-module-1.15.0-10.el8_10.x86_64.rpm
MD5: 4035163fbce8948d8bcec1d03e1841e8
SHA-256: f1ce481d1a11cfdb5379e4c20877fdd6e5c6efdf595a9d61a6e0703353fed423
Size: 311.25 kB
English