SB20250226523 - SUSE update for xorg-x11-server
Published: February 26, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Use-after-free (CVE-ID: CVE-2025-26594)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error of the root cursor. A local user can execute arbitrary code with elevated privileges.
2) Buffer overflow (CVE-ID: CVE-2025-26595)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the XkbVModMaskText() function. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.
3) Heap-based buffer overflow (CVE-ID: CVE-2025-26596)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the XkbWriteKeySyms() function. A local user can trigger a heap-based buffer overflow and execute arbitrary code with elevated privileges.
4) Buffer overflow (CVE-ID: CVE-2025-26597)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the XkbChangeTypesOfKey() function. A local user can trigger memory corruption and execute arbitrary code with elevated privileges.
5) Out-of-bounds write (CVE-ID: CVE-2025-26598)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a boundary error within the CreatePointerBarrierClient() function. A local user can trigger an out-of-bounds write and execute arbitrary code with elevated privileges.
6) Access of uninitialized pointer (CVE-ID: CVE-2025-26599)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to usage of an uninitialized pointer within the compRedirectWindow() function. A local user can execute arbitrary code with elevated privileges.
7) Use-after-free (CVE-ID: CVE-2025-26600)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the PlayReleasedEvents() function. A local user can execute arbitrary code with elevated privileges.
8) Use-after-free (CVE-ID: CVE-2025-26601)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the SyncInitTrigger() function. A local user can execute arbitrary code with elevated privileges.
Remediation
Install update from vendor's website.