{"id":"openSUSE-SU-2026:22085-1","summary":"Security update for xwayland","details":"This update for xwayland fixes the following issues:\n\n- CVE-2026-88812: XKB SetGeometry TextDoodad Double Free (bsc#1281213).\n- CVE-2026-93515: X.Org Server Present Extension Use-After-Free (bsc#1281218).\n- CVE-2026-93516: X.Org Server XInput Passive Grab Use-After-Free (bsc#1281220).\n- CVE-2026-93517: GLX RenderLarge Heap Buffer Overflow (bsc#1281225).\n- CVE-2026-93518: XKB ResizeKeyType Numeric Truncation (bsc#1281227).\n- CVE-2026-93519: XFixes Pointer Barrier Event List Buffer Overflow (bsc#1281233).\n- CVE-2026-93520: XKB ChangeKeycodeRange Heap Out-of-Bounds Write (bsc#1281236).\n- CVE-2026-93521: RandR ChangeProviderProperty Heap Buffer Overflow (bsc#1281238).\n- CVE-2026-93522: Glamor CopyArea Heap Buffer Overflow (bsc#1281240).\n- CVE-2026-93523: XInput2 PassiveUngrabDevice Out-of-Bounds Write (bsc#1281241).\n- CVE-2026-93524: XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read (bsc#1281242).\n- CVE-2026-93536: GestureBuildSprite Use-After-Free (bsc#1281244).\n","modified":"2026-10-19T17:23:13.537832480Z","published":"2026-10-12T08:18:23Z","related":["CVE-2026-88812","CVE-2026-93515","CVE-2026-93516","CVE-2026-93517","CVE-2026-93518","CVE-2026-93519","CVE-2026-93520","CVE-2026-93521","CVE-2026-93522","CVE-2026-93523","CVE-2026-93524","CVE-2026-93536"],"upstream":["CVE-2026-88812","CVE-2026-93515","CVE-2026-93516","CVE-2026-93517","CVE-2026-93518","CVE-2026-93519","CVE-2026-93520","CVE-2026-93521","CVE-2026-93522","CVE-2026-93523","CVE-2026-93524","CVE-2026-93536"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281213"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281218"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281220"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281225"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281227"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281233"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281236"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281238"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281240"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281241"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281242"},{"type":"REPORT","url":"https://bugzilla.suse.com/1281244"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-88812"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93515"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93516"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93517"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93518"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93519"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93520"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93521"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93522"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93523"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93524"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-93536"}],"affected":[{"package":{"name":"xwayland","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/xwayland&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.1.6-160000.7.1"}]}],"ecosystem_specific":{"binaries":[{"xwayland-devel":"24.1.6-160000.7.1","xwayland":"24.1.6-160000.7.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22085-1.json"}}],"schema_version":"1.9.0"}