BSD PortsXorg -- multiple vulnerabilities
· CVE-2025-62229, CVE-2025-62230, CVE-2025-62231 · VuXML entry
https://access.redhat.com/errata/RHSA-2025:19432 reports: CVE-2025-62229: A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption or a crash, potentially allowing an attacker to execute arbitrary code or cause a …
Affected versions
- xorg-server < 21.1.19,1
- xwayland < 24.1.9,1
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | x11-servers/xwayland | 24.1.6,1 | vulnerable since 2025-11-03 | |
| OpenBSD | wayland/xwayland | 24.1.14 | out of range, by version | |
| MidnightBSD | x11-servers/xwayland | 24.1.14,1 | out of range, by version | |
| FreeBSD | x11-servers/xwayland | 24.1.14,1 | fixed | (247 days after) |