{"id":"OESA-2026-4729","summary":"xorg-x11-server-xwayland security update","details":"Xwayland is an X server for running X clients under Wayland.   %package devel Summary: Development package Requires: pkgconfig   %description devel The development package provides the developmental files which are necessary for developing Wayland compositors using Xwayland.   %prep %autosetup -n xwayland- -p1   %build %meson \\         -Ddefault_font_path="catalogue:/etc/X11/fontpath.d,built-ins" \\         -Dbuilder_string="Build ID:  -" \\         -Dxkb_output_dir=/lib/xkb \\         -Dxcsecurity=true \\         -Dglamor=true \\         -Ddri3=true   %meson_build\r\n\r\nSecurity Fix(es):\n\n['Hi all,\\n\\nCVEs have been issued now, please see inline below\\n\\nOn Tue, Jun 02, 2026 at 10:01:46AM +1000, Peter Hutterer wrote:', "=======================================================================\\nX.Org Security Advisory: June 2, 2026 \\n\\nIssues in X.Org X server prior to 21.1.23 and Xwayland prior to 24.1.12\\n=======================================================================\\n\\nMultiple issues have been found in the X server and Xwayland implementations\\npublished by X.Org for which we are releasing security fixes for in\\nxorg-server-21.1.23 and xwayland-24.1.12.\\n\\nNote that CVEs have been requested for these issues but did not get assigned in\\ntime for this disclosure.\\n\\n* Font Alias Stack-based Buffer Overflow\\n\\n    A mismatch between the X server and the libXfont2 library's maximum\\n    font name length can cause a stack buffer overflow during font alias\\n    resolution. The server allocates a 256 byte stack buffer but libXfont2's\\n    alias target name length is 1024 bytes. A font alias name between 257\\n    and 1023 bytes causes the X server to copy that name into the undersized\\n    stack buffer without further checks.\\n\\n    Fixed in: xorg-server-21.1.23 and xwayland-24.1.12\\n    Fix:", 'Found by: Anonymous working with TrendAI Zero Day Initiative.\\n              (ZDI-CAN-30136)', 'This issue has been assigned CVE-2026-50256', '* XSYNC Use-After-Free in miSyncDestroyFence()\\n\\n    A client that sets up multiple fence triggers can trigger a\\n    use-after-free function pointer call. An attacker would connect to the\\n    X server to set up a fence and await that fence, then a second X\\n    connection destroys the fence, causing the use-after-free.\\n\\n    Fixed in: xorg-server-21.1.23 and xwayland-24.1.12\\n    Fix:', 'Found by: Anonymous working with TrendAI Zero Day Initiative.\\n              (ZDI-CAN-30159)', 'This issue has been assigned CVE-2026-50257', '* XKB Key Types Stack-based Buffer Overflow\\n\\n    The X server has multiple stack buffers that are sized\\n    XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify\\n    or clamp non-canonical key types to XkbMaxShiftLevel. A client can\\n    change key types to excessive shift levels and trigger three separate\\n    stack overflows.\\n\\n    This is caused by an incomplete fix of CVE-2025-26597.\\n\\n    Fixed in: xorg-server-21.1.23 and xwayland-24.1.12\\n    Fix:', 'Found by: Anonymous working with TrendAI Zero Day Initiative.\\n              (ZDI-CAN-30160)', 'This issue has been assigned CVE-2026-50258', '* XKB SetMap Request Stack-based Buffer Overflow\\n\\n    _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256]\\n    indexed by key type index. The helper function CheckKeyTypes() writes\\n    to this buffer at a client-controlled offset, allowing a stack buffer\\n    overflow.\\n\\n    Fixed in: xorg-server-21.1.23 and xwayland-24.1.12\\n    Fix:', 'Found by: Anonymous working with TrendAI Zero Day Initiative.\\n              (ZDI-CAN-30161)', 'This issue has been assigned CVE-2026-50259', '* XSYNC Use-After-Free in FreeCounter()\\n\\n    A client that sets up multiple SyncCounters and awaits on those\\n    triggers can trigger a use-after-free when destroying those counters\\n    via a second client connection.\\n\\n    Fixed in: xorg-server-21.1.23 and xwayland-24.1.12\\n    Fix:', 'Found by: Anonymous working with TrendAI Zero Day Initiative.\\n              (ZDI-CAN-30163)', 'This issue has been assigned CVE-2026-50260', '* XSYNC Use-After-Free in SyncChangeCounter()\\n\\n    A client that sets up multiple SyncCounters can trigger a use-after-free\\n    when destroying those counters via a second client connection while\\n    changing those counters.\\n\\n    Fixed in: xorg-server-21.1.23 and xwayland-24.1.12\\n    Fix:', 'Found by: Anonymous working with TrendAI Zero Day Initiative.\\n              (ZDI-CAN-30164)', 'This issue has been assigned CVE-2026-50261', '* GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write\\n\\n    A wrong size validation check in __glXDisp_ChangeDrawableAttributes()\\n    can read (or write) a client-contr(CVE-2026-50256)","modified":"2026-11-04T14:00:07.481062242Z","published":"2026-11-04T13:54:59Z","upstream":["CVE-2026-50256"],"database_specific":{"severity":"High"},"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4729"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-50256"}],"affected":[{"package":{"name":"xorg-x11-server-xwayland","ecosystem":"openEuler:24.03-LTS-SP1","purl":"pkg:rpm/openEuler/xorg-x11-server-xwayland&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"xorg-x11-server-Xwayland-22.1.2-38.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["xorg-x11-server-Xwayland-22.1.2-38.oe2403sp1.aarch64.rpm","xorg-x11-server-Xwayland-debuginfo-22.1.2-38.oe2403sp1.aarch64.rpm","xorg-x11-server-Xwayland-debugsource-22.1.2-38.oe2403sp1.aarch64.rpm","xorg-x11-server-Xwayland-devel-22.1.2-38.oe2403sp1.aarch64.rpm"],"src":["xorg-x11-server-Xwayland-22.1.2-38.oe2403sp1.src.rpm"],"x86_64":["xorg-x11-server-Xwayland-22.1.2-38.oe2403sp1.x86_64.rpm","xorg-x11-server-Xwayland-debuginfo-22.1.2-38.oe2403sp1.x86_64.rpm","xorg-x11-server-Xwayland-debugsource-22.1.2-38.oe2403sp1.x86_64.rpm","xorg-x11-server-Xwayland-devel-22.1.2-38.oe2403sp1.x86_64.rpm"]},"database_specific":{"source":"https://repo.openeuler.org/security/data/osv/OESA-2026-4729.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}