Red Hat Bugzilla – Bug 1209943
CVE-2013-7439 libX11: buffer overflow in MakeBigReq macro
Last modified: 2015-08-22 02:34:44 EDT
The MakeBigReq macro in libX11 before version 1.5.99.901 contained a 4-byte buffer overflow: https://bugs.freedesktop.org/show_bug.cgi?id=56508 Fixed by the following commit in libX11 1.5.99.901: http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=39547d600a13713e15429f49768e54c3173c828d CVE request: http://seclists.org/oss-sec/2015/q2/73
Statement: This issue does not affect the version of libX11 package as shipped with Red Hat Enterprise Linux 7. This issue was was fixed in Red Hat Enterprise Linux 6 via the following security advisory: https://rhn.redhat.com/errata/RHSA-2014-1436.html This issue affects the version of libX11 package as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates.
This issue was assigned CVE-2013-7439 via http://www.openwall.com/lists/oss-security/2015/04/09/1
According to http://lists.x.org/archives/xorg-announce/2015-April/002561.html a rebuild of all software using the vulnerable version of the macros is required. Is this tracked somewhere or did this already happen? Did this happen for EPEL?