X.Org Server & XWayland Hit By Four More Security Issues

Last year the X.Org Server disabled byte-swapped clients by default over being a large and known attack surface within the X.Org/XWayland codebase. That's proven itself to further be the case with 3 of 4 new CVEs made public today being around the byte-swapped code.

The byte-swapped client support is around X.Org/XWayland clients of different CPU endianess to be able to connect to the X.Org Server. Different CPU endianess isn't to common these days and the byte-swapped client support was safely disabled last year without much fuss. Three CVEs made public today involve heap buffer over-read/data leakage within ProcXIGetSelectedEvents, ProcXIPassiveGrabDevice, ProcAppleDRICreatePixmap and due to the byte-swapped handling.

A former X.Org logo attempt posted in the forums.

The fourth issue raised today is a user-after-free within ProcRenderAddGlyphs.

XWayland 23.2.5 and X.Org Server 21.1.12 are published today for fixing these latest four security issues. Details within today's security advisory.