BSD Portsxorg server -- Multiple vulnerabilities
· CVE-2025-26594, CVE-2025-26595, CVE-2025-26596, CVE-2025-26597, CVE-2025-26598, CVE-2025-26599, CVE-2025-26600, CVE-2025-26601 · VuXML entry
The X.Org project reports: CVE-2025-26594: Use-after-free of the root cursor The root cursor is referenced in the xserver as a global variable. If a client manages to free the root cursor, the internal reference points to freed memory and causes a use-after-free. CVE-2025-26595: Buffer overflow in XkbVModMaskText() The code in XkbVModMaskText() allocates a fixed sized buffer on the stack and copies the names of the …
Affected versions
- xorg-server, xephyr, xorg-vfbserver < 21.1.16,1
- xorg-nextserver < 21.1.16,2
- xwayland < 24.1.6
By system
0 still vulnerable, 4 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | x11-servers/xorg-server | 21.1.16,1 | fixed | |
| MidnightBSD | x11-servers/xorg-server | 21.1.25,1 | out of range, by version | |
| FreeBSD | x11-servers/xorg-server | 21.1.25,1 | fixed | (489 days after) |
| DragonFly | x11-servers/xwayland | 24.1.6,1 | fixed | |
| OpenBSD | wayland/xwayland | 24.1.14 | out of range, by version | |
| MidnightBSD | x11-servers/xwayland | 24.1.14,1 | out of range, by version | |
| FreeBSD | x11-servers/xwayland | 24.1.14,1 | fixed | (489 days after) |