IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
7.8Hoch

CVE-2025-26600Xorg: xwayland: use-after-free in playreleasedevents()

xserver; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Red Hat Enterprise Linux 7 Ex… Veröffentlicht: (vor 1 Jahr)

Beschreibung

A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.

Schwachstellentyp (CWE): CWE-416

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
enterprise linux 8 —
enterprise linux 9 —
redhat enterprise linux 7.0
Red Hat Red Hat Enterprise Linux 10 all versions
Red Hat Red Hat Enterprise Linux 6 —
Red Hat Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION all versions
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support all versions
Red Hat Red Hat Enterprise Linux 8 all versions
Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support all versions
Red Hat Red Hat Enterprise Linux 8.6 Telecommunications Update Service all versions
Red Hat Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 9 all versions
Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions all versions
Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support all versions
Red Hat Red Hat Enterprise Linux 9.4 Extended Update Support all versions
rhel aus 8.2 —
rhel aus 8.4 —
rhel aus 8.6 —
rhel e4s 8.4 —
rhel e4s 8.6 —
rhel e4s 9.0 —
rhel eus 8.8 —
rhel eus 9.2 —
rhel eus 9.4 —
rhel tus 8.4 —
rhel tus 8.6 —
tigervnc tigervnc —
— xserver < 21.1.16, 22.0.0 – < 24.1.6
x.org x server < 21.1.16
x.org xwayland < 24.1.6

Referenzen und Patches

CPE-Treffer (NVD) (6)
  • cpe:2.3:a:tigervnc:tigervnc:-:*:*:*:*:*:*:*
  • cpe:2.3:a:x.org:x_server:*:*:*:*:*:*:*:* < 21.1.16
  • cpe:2.3:a:x.org:xwayland:*:*:*:*:*:*:*:* < 24.1.6
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

Neue CVEs im selben Produkt — Nextcloud

7.5Hoch
CVE-2026-77167
Nextcloud server

Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write…

5.3Mittel
CVE-2026-77172
Nextcloud Server

App passwords were allowed to bypass password confirmation on sensitive endpoints.

4.3Mittel
CVE-2026-82984
Nextcloud Server

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumer…

6.5Mittel
CVE-2026-77165
Nextcloud Server

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

3.1Niedrig
CVE-2026-68493
Nextcloud Server

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

6.2Mittel
CVE-2026-77164
Nextcloud Server

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public…