UbuntuUpdates.org

Package "libx11"

Name: libx11

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • X11 client-side library
  • X11 client-side library
  • X11 client-side library (development headers)
  • X11 client-side library (development documentation)
Latest version: 2:1.7.5-1ubuntu0.4
Release: jammy (22.04)
Level: security
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "libx11" in Jammy

Repository Area Version
base main 2:1.7.5-1
updates main 2:1.7.5-1ubuntu0.4

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 2:1.7.5-1ubuntu0.4 2026-10-12 14:07:26 UTC

libx11 (2:1.7.5-1ubuntu0.4) jammy-security; urgency=medium

  * SECURITY UPDATE: heap buffer overflow in _XkbReadKeyActions()
    - debian/patches/CVE-2026-88806.patch: check the keysym range in
      _XkbReadKeyActions() in src/xkb/XKBGetMap.c.
    - CVE-2026-88806
  * SECURITY UPDATE: out-of-bounds read in XIM attribute parser
    - debian/patches/CVE-2026-94283.patch: bound XIM_OPEN_REPLY attribute
      lengths to the received packet in modules/im/ximcp/imDefIm.c,
      modules/im/ximcp/imRmAttr.c and src/xlibi18n/XimintP.h.
    - CVE-2026-94283
  * SECURITY UPDATE: out-of-bounds read in XIM trigger-key registration
    - debian/patches/CVE-2026-94284.patch: bound XIM_REGISTER_TRIGGERKEYS
      keylist lengths to the packet in modules/im/ximcp/imDefLkup.c.
    - CVE-2026-94284
  * SECURITY UPDATE: out-of-bounds read in byte-oriented codeset parser
    - debian/patches/CVE-2026-94285.patch: bound byteM_parse_codeset() reads
      to the remaining input length in modules/lc/gen/lcGenConv.c.
    - CVE-2026-94285

 -- Nick Galanis Thu, 08 Oct 2026 14:13:21 +0300
Source diff to previous version
CVE-2026-88806 A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
CVE-2026-94283 An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X servers to
CVE-2026-94284 An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X servers to c
CVE-2026-94285 An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attached X clien

Version: 2:1.7.5-1ubuntu0.3 2023-10-03 19:10:14 UTC

  libx11 (2:1.7.5-1ubuntu0.3) jammy-security; urgency=medium

  * SECURITY UPDATE: out-of-bounds memory access in _XkbReadKeySyms()
    - d/p/0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
    - CVE-2023-43785
  * SECURITY UPDATE: stack exhaustion from infinite recursion in
    PutSubImage()
    - d/p/0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
    - d/p/0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch
    - CVE-2023-43786
  * SECURITY UPDATE: integer overflow in XCreateImage() leading to a heap
    overflow
    - d/p/0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
    - d/p/0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
    - CVE-2023-43787

 -- Marc Deslauriers <email address hidden> Mon, 02 Oct 2023 15:13:58 -0400
Source diff to previous version
CVE-2023-43785 libX11: out-of-bounds memory access in _XkbReadKeySyms()
CVE-2023-43786 libX11: stack exhaustion from infinite recursion in PutSubImage()
CVE-2023-43787 ibX11: integer overflow in XCreateImage() leading to a heap overflow

Version: 2:1.7.5-1ubuntu0.2 2023-06-15 18:07:01 UTC

  libx11 (2:1.7.5-1ubuntu0.2) jammy-security; urgency=medium

  * SECURITY UPDATE: multiple buffer overflows
    - debian/patches/CVE-2023-3138.patch: add bounds checks for extension
      request, event, & error codes in src/InitExt.c.
    - CVE-2023-3138

 -- Marc Deslauriers <email address hidden> Tue, 13 Jun 2023 07:25:59 -0400


About   -   Send Feedback to @ubuntu_updates