mirror of
https://github.com/X11Libre/xserver.git
synced 2026-03-24 08:04:30 +00:00
3d886958e6
The XkbCompatMap structure stores its "num_si" and "size_si" fields using an unsigned short. However, the function _XkbSetCompatMap() will store the sum of the input data "firstSI" and "nSI" in both XkbCompatMap's "num_si" and "size_si" without first checking if the sum overflows the maximum unsigned short value, leading to a possible overflow. To avoid the issue, check whether the sum does not exceed the maximum unsigned short value, or return a "BadValue" error otherwise. CVE-2025-62231, ZDI-CAN-27560 This vulnerability was discovered by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative Signed-off-by: Olivier Fourdan <ofourdan@redhat.com> Reviewed-by: Michel Dänzer <mdaenzer@redhat.com> Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/2086>
The X server uses this directory to store the compiled version of the
current keymap and/or any scratch keymaps used by clients. The X server
or some other tool might destroy or replace the files in this directory,
so it is not a safe place to store compiled keymaps for long periods of
time. The default keymap for any server is usually stored in:
X<num>-default.xkm
where <num> is the display number of the server in question, which makes
it possible for several servers *on the same host* to share the same
directory.
Unless the X server is modified, sharing this directory between servers on
different hosts could cause problems.