Wlroots
Monthly
An out-of-bounds read in wlroots's XWayland window-management code (read_surface_class() in xwayland/xwm.c) lets a local X11 client leak a small amount of compositor heap memory by setting a WM_CLASS property whose instance string is NUL-terminated but whose class string is not. All wlroots releases before 0.20.2 are affected, but only when the compositor runs with XWayland support active and an attacker already has a local client inside that session. The over-read bytes are surfaced back as the window class or app_id over IPC, giving confidentiality-only exposure with no integrity or availability impact; the vendor shipped a fix in 0.20.2, and no public exploit code was identified at time of analysis.
An out-of-bounds read in wlroots's XWayland window-management code (read_surface_class() in xwayland/xwm.c) lets a local X11 client leak a small amount of compositor heap memory by setting a WM_CLASS property whose instance string is NUL-terminated but whose class string is not. All wlroots releases before 0.20.2 are affected, but only when the compositor runs with XWayland support active and an attacker already has a local client inside that session. The over-read bytes are surfaced back as the window class or app_id over IPC, giving confidentiality-only exposure with no integrity or availability impact; the vendor shipped a fix in 0.20.2, and no public exploit code was identified at time of analysis.