OESA-2025-1429

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1429
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2025-1429.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2025-1429
Upstream
Published
2025-04-18T13:49:43Z
Modified
2025-08-12T05:49:34.078122Z
Summary
xorg-x11-server security update
Details

X.Org X11 X server

Security Fix(es):

A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.(CVE-2025-26594)

A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the data regardless of the size.(CVE-2025-26595)

A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.(CVE-2025-26596)

A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this will cause a buffer overflow because the key actions are of the wrong size.(CVE-2025-26597)

An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the last element of the list if no matching device ID is found, which can lead to out-of-bounds memory access.(CVE-2025-26598)

An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree marked just before, which leaves the validated data partly initialized and the use of an uninitialized pointer later.(CVE-2025-26599)

A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.(CVE-2025-26600)

A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes triggers an error, the function will return early, not adding the new sync object, possibly causing a use-after-free when the alarm eventually triggers.(CVE-2025-26601)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:24.03-LTS-SP1 / xorg-x11-server

Package

Name
xorg-x11-server
Purl
pkg:rpm/openEuler/xorg-x11-server&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.20.11-37.oe2403sp1

Ecosystem specific 

{
    "aarch64": [
        "xorg-x11-server-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-Xdmx-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-Xephyr-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-Xnest-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-Xvfb-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-common-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-debuginfo-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-debugsource-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-devel-1.20.11-37.oe2403sp1.aarch64.rpm"
    ],
    "x86_64": [
        "xorg-x11-server-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-Xdmx-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-Xephyr-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-Xnest-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-Xvfb-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-common-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-debuginfo-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-debugsource-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-devel-1.20.11-37.oe2403sp1.x86_64.rpm"
    ],
    "src": [
        "xorg-x11-server-1.20.11-37.oe2403sp1.src.rpm"
    ],
    "noarch": [
        "xorg-x11-server-help-1.20.11-37.oe2403sp1.noarch.rpm",
        "xorg-x11-server-source-1.20.11-37.oe2403sp1.noarch.rpm"
    ]
}

openEuler:20.03-LTS-SP4 / xorg-x11-server

Package

Name
xorg-x11-server
Purl
pkg:rpm/openEuler/xorg-x11-server&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.20.8-32.oe2003sp4

Ecosystem specific 

{
    "aarch64": [
        "xorg-x11-server-1.20.8-32.oe2003sp4.aarch64.rpm",
        "xorg-x11-server-Xephyr-1.20.8-32.oe2003sp4.aarch64.rpm",
        "xorg-x11-server-debuginfo-1.20.8-32.oe2003sp4.aarch64.rpm",
        "xorg-x11-server-debugsource-1.20.8-32.oe2003sp4.aarch64.rpm",
        "xorg-x11-server-devel-1.20.8-32.oe2003sp4.aarch64.rpm"
    ],
    "x86_64": [
        "xorg-x11-server-1.20.8-32.oe2003sp4.x86_64.rpm",
        "xorg-x11-server-Xephyr-1.20.8-32.oe2003sp4.x86_64.rpm",
        "xorg-x11-server-debuginfo-1.20.8-32.oe2003sp4.x86_64.rpm",
        "xorg-x11-server-debugsource-1.20.8-32.oe2003sp4.x86_64.rpm",
        "xorg-x11-server-devel-1.20.8-32.oe2003sp4.x86_64.rpm"
    ],
    "src": [
        "xorg-x11-server-1.20.8-32.oe2003sp4.src.rpm"
    ],
    "noarch": [
        "xorg-x11-server-help-1.20.8-32.oe2003sp4.noarch.rpm"
    ]
}

openEuler:22.03-LTS-SP3 / xorg-x11-server

Package

Name
xorg-x11-server
Purl
pkg:rpm/openEuler/xorg-x11-server&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.20.11-35.oe2203sp3

Ecosystem specific 

{
    "aarch64": [
        "xorg-x11-server-1.20.11-35.oe2203sp3.aarch64.rpm",
        "xorg-x11-server-Xdmx-1.20.11-35.oe2203sp3.aarch64.rpm",
        "xorg-x11-server-Xephyr-1.20.11-35.oe2203sp3.aarch64.rpm",
        "xorg-x11-server-Xnest-1.20.11-35.oe2203sp3.aarch64.rpm",
        "xorg-x11-server-Xvfb-1.20.11-35.oe2203sp3.aarch64.rpm",
        "xorg-x11-server-common-1.20.11-35.oe2203sp3.aarch64.rpm",
        "xorg-x11-server-debuginfo-1.20.11-35.oe2203sp3.aarch64.rpm",
        "xorg-x11-server-debugsource-1.20.11-35.oe2203sp3.aarch64.rpm",
        "xorg-x11-server-devel-1.20.11-35.oe2203sp3.aarch64.rpm"
    ],
    "x86_64": [
        "xorg-x11-server-1.20.11-35.oe2203sp3.x86_64.rpm",
        "xorg-x11-server-Xdmx-1.20.11-35.oe2203sp3.x86_64.rpm",
        "xorg-x11-server-Xephyr-1.20.11-35.oe2203sp3.x86_64.rpm",
        "xorg-x11-server-Xnest-1.20.11-35.oe2203sp3.x86_64.rpm",
        "xorg-x11-server-Xvfb-1.20.11-35.oe2203sp3.x86_64.rpm",
        "xorg-x11-server-common-1.20.11-35.oe2203sp3.x86_64.rpm",
        "xorg-x11-server-debuginfo-1.20.11-35.oe2203sp3.x86_64.rpm",
        "xorg-x11-server-debugsource-1.20.11-35.oe2203sp3.x86_64.rpm",
        "xorg-x11-server-devel-1.20.11-35.oe2203sp3.x86_64.rpm"
    ],
    "src": [
        "xorg-x11-server-1.20.11-35.oe2203sp3.src.rpm"
    ],
    "noarch": [
        "xorg-x11-server-help-1.20.11-35.oe2203sp3.noarch.rpm",
        "xorg-x11-server-source-1.20.11-35.oe2203sp3.noarch.rpm"
    ]
}

openEuler:22.03-LTS-SP4 / xorg-x11-server

Package

Name
xorg-x11-server
Purl
pkg:rpm/openEuler/xorg-x11-server&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.20.11-35.oe2203sp4

Ecosystem specific 

{
    "aarch64": [
        "xorg-x11-server-1.20.11-35.oe2203sp4.aarch64.rpm",
        "xorg-x11-server-Xdmx-1.20.11-35.oe2203sp4.aarch64.rpm",
        "xorg-x11-server-Xephyr-1.20.11-35.oe2203sp4.aarch64.rpm",
        "xorg-x11-server-Xnest-1.20.11-35.oe2203sp4.aarch64.rpm",
        "xorg-x11-server-Xvfb-1.20.11-35.oe2203sp4.aarch64.rpm",
        "xorg-x11-server-common-1.20.11-35.oe2203sp4.aarch64.rpm",
        "xorg-x11-server-debuginfo-1.20.11-35.oe2203sp4.aarch64.rpm",
        "xorg-x11-server-debugsource-1.20.11-35.oe2203sp4.aarch64.rpm",
        "xorg-x11-server-devel-1.20.11-35.oe2203sp4.aarch64.rpm"
    ],
    "x86_64": [
        "xorg-x11-server-1.20.11-35.oe2203sp4.x86_64.rpm",
        "xorg-x11-server-Xdmx-1.20.11-35.oe2203sp4.x86_64.rpm",
        "xorg-x11-server-Xephyr-1.20.11-35.oe2203sp4.x86_64.rpm",
        "xorg-x11-server-Xnest-1.20.11-35.oe2203sp4.x86_64.rpm",
        "xorg-x11-server-Xvfb-1.20.11-35.oe2203sp4.x86_64.rpm",
        "xorg-x11-server-common-1.20.11-35.oe2203sp4.x86_64.rpm",
        "xorg-x11-server-debuginfo-1.20.11-35.oe2203sp4.x86_64.rpm",
        "xorg-x11-server-debugsource-1.20.11-35.oe2203sp4.x86_64.rpm",
        "xorg-x11-server-devel-1.20.11-35.oe2203sp4.x86_64.rpm"
    ],
    "src": [
        "xorg-x11-server-1.20.11-35.oe2203sp4.src.rpm"
    ],
    "noarch": [
        "xorg-x11-server-help-1.20.11-35.oe2203sp4.noarch.rpm",
        "xorg-x11-server-source-1.20.11-35.oe2203sp4.noarch.rpm"
    ]
}

openEuler:24.03-LTS / xorg-x11-server

Package

Name
xorg-x11-server
Purl
pkg:rpm/openEuler/xorg-x11-server&distro=openEuler-24.03-LTS

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.20.11-37.oe2403

Ecosystem specific 

{
    "aarch64": [
        "xorg-x11-server-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-Xdmx-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-Xephyr-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-Xnest-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-Xvfb-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-common-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-debuginfo-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-debugsource-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-devel-1.20.11-37.oe2403sp1.aarch64.rpm",
        "xorg-x11-server-1.20.11-37.oe2403.aarch64.rpm",
        "xorg-x11-server-Xdmx-1.20.11-37.oe2403.aarch64.rpm",
        "xorg-x11-server-Xephyr-1.20.11-37.oe2403.aarch64.rpm",
        "xorg-x11-server-Xnest-1.20.11-37.oe2403.aarch64.rpm",
        "xorg-x11-server-Xvfb-1.20.11-37.oe2403.aarch64.rpm",
        "xorg-x11-server-common-1.20.11-37.oe2403.aarch64.rpm",
        "xorg-x11-server-debuginfo-1.20.11-37.oe2403.aarch64.rpm",
        "xorg-x11-server-debugsource-1.20.11-37.oe2403.aarch64.rpm",
        "xorg-x11-server-devel-1.20.11-37.oe2403.aarch64.rpm"
    ],
    "x86_64": [
        "xorg-x11-server-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-Xdmx-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-Xephyr-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-Xnest-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-Xvfb-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-common-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-debuginfo-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-debugsource-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-devel-1.20.11-37.oe2403sp1.x86_64.rpm",
        "xorg-x11-server-1.20.11-37.oe2403.x86_64.rpm",
        "xorg-x11-server-Xdmx-1.20.11-37.oe2403.x86_64.rpm",
        "xorg-x11-server-Xephyr-1.20.11-37.oe2403.x86_64.rpm",
        "xorg-x11-server-Xnest-1.20.11-37.oe2403.x86_64.rpm",
        "xorg-x11-server-Xvfb-1.20.11-37.oe2403.x86_64.rpm",
        "xorg-x11-server-common-1.20.11-37.oe2403.x86_64.rpm",
        "xorg-x11-server-debuginfo-1.20.11-37.oe2403.x86_64.rpm",
        "xorg-x11-server-debugsource-1.20.11-37.oe2403.x86_64.rpm",
        "xorg-x11-server-devel-1.20.11-37.oe2403.x86_64.rpm"
    ],
    "src": [
        "xorg-x11-server-1.20.11-37.oe2403sp1.src.rpm",
        "xorg-x11-server-1.20.11-37.oe2403.src.rpm"
    ],
    "noarch": [
        "xorg-x11-server-help-1.20.11-37.oe2403sp1.noarch.rpm",
        "xorg-x11-server-source-1.20.11-37.oe2403sp1.noarch.rpm",
        "xorg-x11-server-help-1.20.11-37.oe2403.noarch.rpm",
        "xorg-x11-server-source-1.20.11-37.oe2403.noarch.rpm"
    ]
}