USN-6587-3
xorg-server, xwayland regression
USN-6587-1 fixed vulnerabilities in X.Org X Server. The fix was incomplete resulting in a possible regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs. An attacker could possibly use this issue to cause the X Server to crash, obtain sensitive information, or execute arbitrary code. (CVE-2023-6816)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled reattaching to a different master device. An attacker could use this issue to cause the X Server to crash, leading to a denial of service, or possibly execute arbitrary code. (CVE-2024-0229)
Olivier Fourdan and Donn Seeley discovered that the X.Org X Server incorrectly labeled GLX PBuffers when used with SELinux. An attacker could use this issue to cause the X Server to crash, leading to a denial of service. (CVE-2024-0408)
Olivier Fourdan discovered that the X.Org X Server incorrectly handled the curser code when used with SELinux. An attacker could use this issue to cause the X Server to crash, leading to a denial of service. (CVE-2024-0409)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the XISendDeviceHierarchyEvent API. An attacker could possibly use this issue to cause the X Server to crash, or execute arbitrary code. (CVE-2024-21885)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled devices being disabled. An attacker could possibly use this issue to cause the X Server to crash, or execute arbitrary code. (CVE-2024-21886)
What each source reports
OSV No score
xorg-server, xwayland regression
USN-6587-1 fixed vulnerabilities in X.Org X Server. The fix was incomplete resulting in a possible regression. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the DeviceFocusEvent and ProcXIQueryPointer APIs. An attacker could possibly use this issue to cause the X Server to crash, obtain sensitive information, or execute arbitrary code. (CVE-2023-6816)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled reattaching to a different master device. An attacker could use this issue to cause the X Server to crash, leading to a denial of service, or possibly execute arbitrary code. (CVE-2024-0229)
Olivier Fourdan and Donn Seeley discovered that the X.Org X Server incorrectly labeled GLX PBuffers when used with SELinux. An attacker could use this issue to cause the X Server to crash, leading to a denial of service. (CVE-2024-0408)
Olivier Fourdan discovered that the X.Org X Server incorrectly handled the curser code when used with SELinux. An attacker could use this issue to cause the X Server to crash, leading to a denial of service. (CVE-2024-0409)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled memory when processing the XISendDeviceHierarchyEvent API. An attacker could possibly use this issue to cause the X Server to crash, or execute arbitrary code. (CVE-2024-21885)
Jan-Niklas Sohn discovered that the X.Org X Server incorrectly handled devices being disabled. An attacker could possibly use this issue to cause the X Server to crash, or execute arbitrary code. (CVE-2024-21886)
- Record
USN-6587-3- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xorg-serverUbuntu:20.04:LTS |
before 2:1.20.13-1ubuntu1~20.04.15, plus listed versions 2:1.20.5+git20191008-0ubuntu12:1.20.6-1ubuntu12:1.20.7-2ubuntu12:1.20.7-2ubuntu22:1.20.8-2ubuntu2 Show 18 moreShow less2:1.20.8-2ubuntu2.12:1.20.8-2ubuntu2.22:1.20.8-2ubuntu2.32:1.20.8-2ubuntu2.42:1.20.8-2ubuntu2.62:1.20.9-2ubuntu1.1~20.04.12:1.20.9-2ubuntu1.2~20.04.12:1.20.9-2ubuntu1.2~20.04.22:1.20.11-1ubuntu1~20.04.22:1.20.13-1ubuntu1~20.04.22:1.20.13-1ubuntu1~20.04.32:1.20.13-1ubuntu1~20.04.42:1.20.13-1ubuntu1~20.04.52:1.20.13-1ubuntu1~20.04.62:1.20.13-1ubuntu1~20.04.82:1.20.13-1ubuntu1~20.04.92:1.20.13-1ubuntu1~20.04.122:1.20.13-1ubuntu1~20.04.14 |
2:1.20.13-1ubuntu1~20.04.15 |
xorg-serverUbuntu:22.04:LTS |
before 2:21.1.4-2ubuntu1.7~22.04.8, plus listed versions 2:1.20.13-1ubuntu12:1.20.13-1ubuntu22:1.20.14-1ubuntu12:21.1.3-2ubuntu22:21.1.3-2ubuntu2.1 Show 12 moreShow less2:21.1.3-2ubuntu2.22:21.1.3-2ubuntu2.32:21.1.3-2ubuntu2.42:21.1.3-2ubuntu2.52:21.1.3-2ubuntu2.62:21.1.3-2ubuntu2.72:21.1.3-2ubuntu2.82:21.1.3-2ubuntu2.92:21.1.4-2ubuntu1.7~22.04.12:21.1.4-2ubuntu1.7~22.04.22:21.1.4-2ubuntu1.7~22.04.52:21.1.4-2ubuntu1.7~22.04.7 |
2:21.1.4-2ubuntu1.7~22.04.8 |
xwaylandUbuntu:22.04:LTS |
before 2:22.1.1-1ubuntu0.11, plus listed versions 2:21.1.2-0ubuntu12:21.1.3-12:21.1.3-1ubuntu12:21.1.4-12:22.1.0-1 Show 10 moreShow less2:22.1.1-12:22.1.1-1ubuntu0.12:22.1.1-1ubuntu0.22:22.1.1-1ubuntu0.32:22.1.1-1ubuntu0.42:22.1.1-1ubuntu0.52:22.1.1-1ubuntu0.62:22.1.1-1ubuntu0.72:22.1.1-1ubuntu0.92:22.1.1-1ubuntu0.10 |
2:22.1.1-1ubuntu0.11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-6587-3 is a vulnerability with no CVSS score yet in xorg-server, published January 30, 2024. No source lists public exploit code. Fixed in xorg-server 2:1.20.13-1ubuntu1~20.04.15.