CLSA-2026-1782812906
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1782812906.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1782812906
- Upstream
- Published
- 2026-06-30T09:48:54Z
- Modified
- 2026-10-26T09:43:53Z
- Summary
- tigervnc: Fix of 8 CVEs
- Details
-
- CVE-2026-50256: increase XLFDMAXFONTNAMELEN to 1024 and bound-check resolved font-alias names before copying into the pattern buffers, preventing a stack overflow during alias resolution (bundled xorg-server)
- CVE-2026-50257, CVE-2026-50260: fix use-after-free when destroying sync fences (miSyncDestroyFence) and counters (FreeCounter) whose trigger list is shared across an Await group (bundled xorg-server)
- CVE-2026-50258: reject XKB key types whose numLevels exceeds XkbMaxShiftLevel in CheckKeyTypes, preventing a stack overflow in XkbKeyTypesForCoreSymbols (bundled xorg-server)
- CVE-2026-50259: clamp nMaps to the mapWidths buffer size in CheckKeyTypes so an XkbSetMap resize request cannot overflow the stack buffer (bundled xorg-server)
- CVE-2026-50261: restart trigger-list iteration in SyncChangeCounter after a trigger fires, preventing a use-after-free of freed trigger nodes (bundled xorg-server)
- CVE-2026-50262: enforce an exact request size in glx ChangeDrawableAttributes, fixing a reversed length check that allowed an out-of-bounds read/write (bundled xorg-server)
- CVE-2026-50263: re-fetch the screen-saver screen private after CheckScreenPrivate in CreateSaverWindow, preventing a use-after-free (bundled xorg-server)
- References
-
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1782812906.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-50256
- https://nvd.nist.gov/vuln/detail/CVE-2026-50257
- https://nvd.nist.gov/vuln/detail/CVE-2026-50258
- https://nvd.nist.gov/vuln/detail/CVE-2026-50259
- https://nvd.nist.gov/vuln/detail/CVE-2026-50260
- https://nvd.nist.gov/vuln/detail/CVE-2026-50261
- https://nvd.nist.gov/vuln/detail/CVE-2026-50262
- https://nvd.nist.gov/vuln/detail/CVE-2026-50263