Debian Security Advisory

DSA-4920-1 libx11 -- security update

Date Reported:
24 May 2021
Affected Packages:
Security database references:
In the Debian bugtracking system: Bug 988737.
In Mitre's CVE dictionary: CVE-2021-31535.
More information:

Roman Fiedler reported that missing length validation in various functions provided by libx11, the X11 client-side library, allow to inject X11 protocol commands on X clients, leading to authentication bypass, denial of service or potentially the execution of arbitrary code.

For the stable distribution (buster), this problem has been fixed in version 2:1.6.7-1+deb10u2.

We recommend that you upgrade your libx11 packages.

For the detailed security status of libx11 please refer to its security tracker page at: