XWayland 22.1.3 Released Due To XKB Security Vulnerabilities

Disclosed on Tuesday were two new X.Org Server security vulnerabilities concerning possible local privilege escalation and remote code execution. X.Org Server 21.1.4 was released with these mitigations to the XKB extension while XWayland is also vulnerable and has now been patched with XWayland 22.1.3.

While there were Phoronix readers quick to promote Wayland in light of the XKB security vulnerabilities with the X.Org Server, for those Wayland users still relying on legacy X11 clients via XWayland there is exposure. But at least the primary threat with these security vulnerabilities is to those still running the X Server process with privileged rights.

Olivier Fourdan of Red Hat released XWayland 212.1.3 that contains the XKB security fixes around out-of-bounds memory writes. There are also a few other minor fixes too with this point release.