Logo
componentwayland
Name
wayland
Version
1.20.0
Type
library
Description
Wayland, a protocol between a compositor and clients
Licenses
MIT
PURL
-
CPE
cpe:2.3:*:wayland:wayland:1.20.0:*:*:*:*:*:*:*

Other Versions#


Project
Branch
Version
master
1.25.0
scarthgap
1.22.0

Patches#


#
Title
Author
Resolve
1
build: Fix strndup detection on MinGW
Joshua Watt <JPEWhacker@gmail.com>
2
util: Limit size of wl_map
Derek Foreman <derek.foreman@collabora.com>
CVE-2021-3782
3
Do not hardcode the path to wayland-scanner
Alexander Kanavin <alex.kanavin@gmail.com>

Vulnerabilities#


Name
Analysis
Description
Patched
An internal reference count is held on the buffer pool, incremented every time a new buffer is created from the pool. The reference count is maintained as an int; on LP64 systems this can cause the reference count to overflow if the client creates a large number of wl_shm buffer objects, or if it can coerce the server to create a large number of external references to the buffer storage. With the reference count overflowing, a use-after-free can be constructed on the wl_shm_pool tracking structure, where values may be incremented or decremented; it may also be possible to construct a limited oracle to leak 4 bytes of server-side memory to the attacking client at a time.