xorg-x11-server (SUSE:Manager Server 4.3) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Manager Server 4.3 package xorg-x11-server, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (24)

• CVE-2023-6816 — CVSS 9.8 (critical): A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down…
• CVE-2024-0229 — CVSS 7.8 (high): An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is…
• CVE-2024-0409 — CVSS 7.8 (high): A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the…
• CVE-2024-21885 — CVSS 7.8 (high): A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when…
• CVE-2024-21886 — CVSS 7.8 (high): A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in…
• CVE-2025-49180 — CVSS 7.8 (high): A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to…
• CVE-2025-26594 — CVSS 7.8 (high): A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client…
• CVE-2025-26595 — CVSS 7.8 (high): A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and…
• CVE-2025-26596 — CVSS 7.8 (high): A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in…
• CVE-2025-26597 — CVSS 7.8 (high): A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols…
• CVE-2025-26598 — CVSS 7.8 (high): An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its…
• CVE-2025-26599 — CVSS 7.8 (high): An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate…
• CVE-2025-26600 — CVSS 7.8 (high): A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device…
• CVE-2025-26601 — CVSS 7.8 (high): A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the…
• CVE-2024-31083 — CVSS 7.8 (high): A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is…
• CVE-2024-9632 — CVSS 7.8 (high): A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to…
• CVE-2024-31080 — CVSS 7.3 (high): A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when…
• CVE-2024-31081 — CVSS 7.3 (high): A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when…
• CVE-2024-31082 — CVSS 7.3 (high): A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when…
• CVE-2025-49176 — CVSS 7.3 (high): A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size…
• CVE-2025-49179 — CVSS 7.3 (high): A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when…
• CVE-2025-49175 — CVSS 6.1 (medium): A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least…
• CVE-2025-49178 — CVSS 5.5 (medium): A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip…
• CVE-2024-0408 — CVSS 5.5 (medium): A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When…