X.Org and Xwayland: Security vulnerabilities enable code smuggling

Several security vulnerabilities in X.Org and Xwayland allow attackers to smuggle in malicious code. Some updates are available.

(Image: Erstellt mit KI in Bing Designer durch heise online / dmk)

Feb 26, 2025 at 11:03 am CET

2 min. read

Security

By

Dirk Knop

Several security vulnerabilities have been discovered in the X.org X11 server and Xwayland. They may allow attackers to inject and execute malicious code. The major Linux distributions are already distributing updated packages.

The discoverer of the gaps, Jan-Niklas Sohn, has reported the eight vulnerabilities according to Ubuntu. In summary, the Ubuntu maintainers write that the X.org X server did not handle certain memory operations correctly: “Attackers can use these issues to crash the X server, resulting in a denial of service, or possibly execute arbitrary code.” However, the authors of the security memo do not discuss how such attacks could look and be detected.

Updated X.org and Xwayland packages

Ubuntu is already distributing updated packages for Ubuntu 20.04, 22.04, 24.04 and 24.10. After installing the updates, those affected should restart their systems to make the necessary changes. Redhat also has updates in its program. At the time of reporting, SUSE still appears to be working on updated packages, and the Debian “Security-Announce” mailing list does not yet contain any information on updates in February. However, these should be released shortly. Admins should apply them as soon as they are available, provided that the X.Org server and Xwayland are still installed on the systems for compatibility reasons, for example.

The vulnerabilities in detail: