Fellow Linux admins-

Multiple significant vulnerabilities were discovered in X.Org and Xwayland that could lead to system compromise, depending on how your X.Org or Xwayland server is started. A use-after-free vulnerability occurs when an application tries to access memory that has already been freed. In this case, it happens within the composite extension of the X.Org server, which can lead to a range of issues, including arbitrary code execution. Read on to learn more about these vulnerabilities and the impact it could have on your system.

You'll also learn about a critical PostgreSQL SQL injection flaw (CVE-2025-1094) that could be exploited to execute arbitrary commands and gain unauthorized control over impacted systems.

If you found value in today’s newsletter, please share it with your friends! Do you have a Linux security-related topic you'd like to cover for our audience? We welcome contributions from passionate, insightful community members who share our love for Linux and security!

Stay safe out there,

Dv Signature Newsletter 2024 Esm W150

Dave Wreski

LinuxSecurity Founder

X.Org

The Discovery 

Eight critical security vulnerabilities affecting both the X.Org Server and XWayland were recently disclosed. These bugs include severe user-after-free and buffer overflow vulnerabilities.

Xorg Esm W251

The Impact

These flaws could allow malicious hackers to compromise data and critical systems. 

 The Fix

X.Org Foundation has released patches for these flaws. Updating to xorg-server-21.1.16 and xwayland-24.1.6 as soon as possible is imperative in mitigating risk.

Your Related Advisories:

[distro_list_1]

PostgreSQL

The Discovery 

A significant critical SQL injection flaw (CVE-2025-1094) has been discovered in the popular open-source database. PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() all improperly handle quoting syntax that allows attackers to inject malicious SQL commands using key libpq functions. 

Postgresql Esm W221

The Impact

This vulnerability could be exploited to execute arbitrary commands and gain unauthorized control over impacted systems.

 The Fix

Important PostgreSQL security updates have been released to fix this bug. All admins using versions before 17.3, 16.7, 15.11, 14.16 or 13.19 should apply these updates promptly to secure their systems and data.

Your Related Advisories:

[distro_list_2]