An update for xorg-x11-server-xwayland is now available for openEuler-22.03-LTS-SP1 Security Advisory openeuler-security@openeuler.org openEuler security committee openEuler-SA-2024-1600 Final 1.0 1.0 2024-05-17 Initial 2024-05-17 2024-05-17 openEuler SA Tool V1.0 2024-05-17 xorg-x11-server-xwayland security update An update for xorg-x11-server-xwayland is now available for openEuler-22.03-LTS-SP1. Xwayland is an X server for running X clients under Wayland. %package devel Summary: Development package Requires: pkgconfig %description devel The development package provides the developmental files which are necessary for developing Wayland compositors using Xwayland. %prep %autosetup -n xwayland- %build %meson \ -Dxwayland_eglstream=true \ -Ddefault_font_path="catalogue:/etc/X11/fontpath.d,built-ins" \ -Dbuilder_string="Build ID: -" \ -Dxkb_output_dir=/lib/xkb \ -Dxcsecurity=true \ -Dglamor=true \ -Ddri3=true %meson_build Security Fix(es): An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments.(CVE-2024-0229) A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.(CVE-2024-0409) An update for xorg-x11-server-xwayland is now available for openEuler-22.03-LTS-SP1. openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section. High xorg-x11-server-xwayland https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1600 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2024-0229 https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2024-0409 https://nvd.nist.gov/vuln/detail/CVE-2024-0229 https://nvd.nist.gov/vuln/detail/CVE-2024-0409 openEuler-22.03-LTS-SP1 xorg-x11-server-Xwayland-devel-22.1.2-5.oe2203sp1.aarch64.rpm xorg-x11-server-Xwayland-22.1.2-5.oe2203sp1.aarch64.rpm xorg-x11-server-Xwayland-debugsource-22.1.2-5.oe2203sp1.aarch64.rpm xorg-x11-server-Xwayland-debuginfo-22.1.2-5.oe2203sp1.aarch64.rpm xorg-x11-server-Xwayland-22.1.2-5.oe2203sp1.src.rpm xorg-x11-server-Xwayland-debuginfo-22.1.2-5.oe2203sp1.x86_64.rpm xorg-x11-server-Xwayland-devel-22.1.2-5.oe2203sp1.x86_64.rpm xorg-x11-server-Xwayland-22.1.2-5.oe2203sp1.x86_64.rpm xorg-x11-server-Xwayland-debugsource-22.1.2-5.oe2203sp1.x86_64.rpm An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments. 2024-05-17 CVE-2024-0229 openEuler-22.03-LTS-SP1 High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H xorg-x11-server-xwayland security update 2024-05-17 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1600 A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context. 2024-05-17 CVE-2024-0409 openEuler-22.03-LTS-SP1 High 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H xorg-x11-server-xwayland security update 2024-05-17 https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1600