Amazon Linux 2023 Security Advisory: ALAS2023-2026-3443
Advisory Released Date: 2026-11-12
Advisory Updated Date: 2026-11-12
FAQs regarding Amazon Linux ALAS/CVE Severity
A bounds-checking flaw in the X.Org Server's XvShmPutImage handling can result in an out-of-bounds read or write, potentially leading to server crashes or memory corruption. (CVE-2026-109092)
A flaw in the X.Org Server's XTestFakeInput handling can result in a stack out-of-bounds write, potentially leading to server crashes or stack memory corruption. (CVE-2026-109093)
An integer overflow flaw in the X.Org Server's glamor Xv image size computation can result in out-of-bounds reads, potentially leading to server crashes or unintended memory access. (CVE-2026-109095)
A flaw in the X.Org Server's XvPutImage length validation can allow requests with missing image data to be processed, potentially leading to server crashes or misbehavior. (CVE-2026-109096)
A flaw in the X.Org Server's XvQueryImageAttributes reply handling can result in clients receiving an incorrect data size value, potentially leading to improper buffer allocation or usage. (CVE-2026-109903)
Affected Packages:
xorg-x11-server-Xwayland
Issue Correction:
Run dnf update xorg-x11-server-Xwayland --releasever 2023.12.20261112 or dnf update --advisory ALAS2023-2026-3443 --releasever 2023.12.20261112 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
aarch64:
xorg-x11-server-Xwayland-debuginfo-24.1.3-1.amzn2023.0.8.aarch64
xorg-x11-server-Xwayland-devel-24.1.3-1.amzn2023.0.8.aarch64
xorg-x11-server-Xwayland-24.1.3-1.amzn2023.0.8.aarch64
xorg-x11-server-Xwayland-debugsource-24.1.3-1.amzn2023.0.8.aarch64
src:
xorg-x11-server-Xwayland-24.1.3-1.amzn2023.0.8.src
x86_64:
xorg-x11-server-Xwayland-debuginfo-24.1.3-1.amzn2023.0.8.x86_64
xorg-x11-server-Xwayland-24.1.3-1.amzn2023.0.8.x86_64
xorg-x11-server-Xwayland-devel-24.1.3-1.amzn2023.0.8.x86_64
xorg-x11-server-Xwayland-debugsource-24.1.3-1.amzn2023.0.8.x86_64