Bug 959040 (CVE-2013-1981)

Summary:	CVE-2013-1981 libX11: Multiple integer overflows leading to heap-based buffer-overflows
Product:	[Other] Security Response	Reporter:	Huzaifa S. Sidhpurwala <huzaifas>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jlieskov, jrusnack, kem, peter.hutterer, security-response-team
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	libX11 1.5.99.902 (1.6 RC2)	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2014-10-16 06:02:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	966680, 1078019
Bug Blocks:	959130, 1101912

Description Huzaifa S. Sidhpurwala 2013-05-03 04:32:21 UTC

Several integer overflow flaws causing heap-based buffer overflows were found in libX11, the Core X11 protocol client library. 

Note from upstream:

Most of these issues stem from the client libraries trusting the server to send correct protocol data, and not verifying that the values will not overflow or cause other damage.   Most of the time X clients & servers are run by the same user, with the server more privileged from the clients, so this is not a problem, but there are scenarios in which a privileged client can be connected to an unprivileged server, for instance, connecting a setuid X client (such as a screen lock program) to a virtual X server(such as Xvfb or Xephyr) the user has modified to return invalid data, potentially allowing the user to escalate their privileges.

Comment 18 Vincent Danen 2013-05-09 21:51:10 UTC

Affects libX11 1.5.99.901 (1.6 RC1) and earlier

Integer overflows calculating memory needs for replies:

Affected functions:  XQueryFont(), _XF86BigfontQueryFont(), XListFontsWithInfo(), XGetMotionEvents(), XListHosts(), XGetModifierMapping(), XGetPointerMapping(), XGetKeyboardMapping(), XGetWindowProperty(), XGetImage()

Integer overflows parsing user-specified files:

Affected functions:  LoadColornameDB(), XrmGetFileDatabase(), _XimParseStringFile(), TransFileName()

Comment 19 Jan Lieskovsky 2013-05-23 15:25:42 UTC

Public via:
  http://www.openwall.com/lists/oss-security/2013/05/23/3

Comment 20 Jan Lieskovsky 2013-05-23 16:18:57 UTC

Upstream patches:

  Prerequisite:
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=d7f04c340ade3834e603c23d543132e1ee4e0c63
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=9f5d83706543696fc944c1835a403938c06f2cc5

  Patches for issues:
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=6df8a63d34b7514077188e2062a13774f920c085 [1/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=5669a220816b7d58fcaf0c302ead16fbe5c87817 [2/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=39515b7c3ba8cae9021bf6695e378ae19487082f [3/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=1f6a3dbf699b85c0ea715ef21de7e7095a714e12 [4/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=2cd62b5eb99ffbb2fce99f3c459455e630b35bf7 [5/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=90fd5abac2faca86f9f100353a3c9c7b89f31484 [6/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=076428918e6c35f66b9b55c3fa097ff06496d155 [7/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=460e8a223b87d4fa0ea1e97823e998a770e0f2a2 [8/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=164bf4dfe839b1cc75cdeee378a243d04a8200e4 [9/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=79d8dc08eb98842173ce239b9dd60df0e9e9ae72 [10/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=833f6b70bc789d33607f6dbfee9e0a4178ec4b59 [11/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=a351b8103b2ba78882e1c309e85893ca3abe2073 [12/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=0b0f5d4358c3de7563d6af03f0d2ce454702a06a [13/13]

Comment 21 Jan Lieskovsky 2013-05-23 16:24:28 UTC

These issues affects the versions of the libX11 packages, as shipped with Fedora release of 17 and 18. Please schedule an update.

Comment 22 Jan Lieskovsky 2013-05-23 16:38:11 UTC

Created libX11 tracking bugs for this issue

Affects: fedora-all [bug 966680]

Comment 23 Jan Lieskovsky 2013-05-23 17:00:58 UTC

External References:

http://www.x.org/wiki/Development/Security/Advisory-2013-05-23

Comment 24 Fedora Update System 2013-05-27 03:27:07 UTC

libX11-1.5.99.901-3.20130524gita3bdd2b09.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 25 Fedora Update System 2013-05-28 01:02:43 UTC

libX11-1.5.99.901-3.20130524gita3bdd2b09.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 26 Peter Hutterer 2013-05-28 03:04:05 UTC

All packages in stable, closing.

Comment 28 Huzaifa S. Sidhpurwala 2013-06-05 03:30:38 UTC

This issue affects the version of libX11 as shipped with Red Hat Enterprise Linux 5 and 6.

Comment 29 Huzaifa S. Sidhpurwala 2013-06-05 03:45:30 UTC

Statement:

This issue affects the libX11 package in Red Hat Enterprise Linux 5. Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle: https://access.redhat.com/support/policy/updates/errata/

Comment 31 errata-xmlrpc 2014-10-14 05:04:58 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1436 https://rhn.redhat.com/errata/RHSA-2014-1436.html