Detections
Analytics
Amazon Linux 2023 : xorg-x11-server-Xwayland, xorg-x11-server-Xwayland-devel (ALAS2023-2026-1789)
high Nessus Plugin ID 319792
Synopsis
The remote Amazon Linux 2023 host is missing a security update.Description
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1789 advisory.Font Alias Stack-based Buffer Overflow: A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks.
XSYNC Use-After-Free in miSyncDestroyFence(): A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free.
XKB Key Types Stack-based Buffer Overflow: The X server has multiple stack buffers that are sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger three separate stack overflows.
XKB SetMap Request Stack-based Buffer Overflow: _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow.
XSYNC Use-After-Free in FreeCounter(): A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection.
XSYNC Use-After-Free in SyncChangeCounter(): A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters.
GLX ChangeDrawableAttributes Out-Of-Bounds Read/Write: A wrong size validation check in
__glXDisp_ChangeDrawableAttributes() can read (or write) a client-controlled number of bytes, exceeding the request buffer. The write path requires byte-swapped clients which is disabled by default. The read can lead to information disclosure, the write can be used to crash the server, or for privilege escalation if the X server runs as root.
CreateSaverWindow Use-After-Free Information Disclosure: A client can trigger a use-after-free read after changing window attributes and forcing the screen saver. This can lead to information disclosure.
Tenable has extracted the preceding description block directly from the tested product security advisory.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Run 'dnf update xorg-x11-server-Xwayland --releasever 2023.12.20260608' or or 'dnf update --advisory ALAS2023-2026-1789 --releasever 2023.12.20260608' to update your system.See Also
Plugin Details
Severity: High
ID: 319792
File Name: al2023_ALAS2023-2026-1789.nasl
Version: 1.1
Type: Local
Agent: unix
Published: 6/8/2026
Updated: 6/8/2026
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus
Vulnerability Information
CPE: p-cpe:/a:amazon:linux:xorg-x11-server-xwayland-debugsource, p-cpe:/a:amazon:linux:xorg-x11-server-xwayland, p-cpe:/a:amazon:linux:xorg-x11-server-xwayland-devel, cpe:/o:amazon:linux:2023, p-cpe:/a:amazon:linux:xorg-x11-server-xwayland-debuginfo
Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 6/8/2026
Vulnerability Publication Date: 6/8/2026