QSN-8913-1: libx11 vulnerabilities
2026-10-12

Summary:
Several security issues were fixed in libx11.

Details:
Adam Bedard discovered that libx11 incorrectly handled certain XKB keyboard
map replies. If a user were tricked into connecting to a malicious X
server, a remote attacker could possibly use this issue to cause libx11 to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2026-88806)

It was discovered that libx11 incorrectly handled certain X Input Method
(XIM) messages. If a user were tricked into connecting to a malicious X
server, a remote attacker could possibly use these issues to cause libx11
to crash, resulting in a denial of service. (CVE-2026-94283,
CVE-2026-94284)

It was discovered that libx11 incorrectly handled converting certain
multibyte text. An attacker could possibly use this issue to cause libx11
to crash, resulting in a denial of service. (CVE-2026-94285)

Affected QuantaStor releases:
  6.9.1.001 jammy: libx11-6 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.9.1.001 jammy: libx11-data 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.9.0.464 jammy: libx11-6 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.9.0.464 jammy: libx11-data 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.6.015 jammy: libx11-6 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.6.015 jammy: libx11-data 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.5.018 jammy: libx11-6 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.5.018 jammy: libx11-data 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.4.038 jammy: libx11-6 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.4.038 jammy: libx11-data 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.3.018 jammy: libx11-6 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.3.018 jammy: libx11-data 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.2.002 jammy: libx11-6 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.2.002 jammy: libx11-data 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.1.007 jammy: libx11-6 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.1.007 jammy: libx11-data 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.0.205 jammy: libx11-6 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)
  6.8.0.205 jammy: libx11-data 2:1.7.5-1ubuntu0.3 (fixed in 2:1.7.5-1ubuntu0.4)

CVEs: CVE-2026-94283, CVE-2026-94284, CVE-2026-88806, CVE-2026-94285

References:
  https://ubuntu.com/security/notices/USN-8913-1