Bug 842841 (CVE-2012-1699) - CVE-2012-1699 xorg-x11: DoS and information leak in xfs prior to X11R6.7
Summary: CVE-2012-1699 xorg-x11: DoS and information leak in xfs prior to X11R6.7
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2012-1699
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2012-07-24 17:32 UTC by Vincent Danen
Modified: 2021-02-23 14:14 UTC (History)
1 user (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2012-07-24 17:38:36 UTC
Embargoed:

Attachments (Terms of Use)

Description Vincent Danen 2012-07-24 17:32:54 UTC 
From the upstream announcement [1]:

A vulnerability has been found in the X11R6 font server code in the
handling of the SetEventMask request in xfs - if an invalid mask is
specified, it passes that bad mask to the SendErrToClient() function for
returning to the client in the error message.  Unfortunately,
SendErrToClient() expects a pointer, but was being passed the raw mask
value, causing it to use the mask as a pointer, either segfaulting (if that
happened to be an invalid pointer), or returning whatever data happened to
be accessible in the 4 bytes at the address specified by the mask value.

X11R6 through X11R6.6 appear to be vulnerable.   The fix shown below was
introduced by XFree86 in their 3.3.3 release as part of the commit for:
   Prototype/ansification cleanup for Xserver/XIE, xfs, fontlib, mkfontdir,
   and fix some bugs found along the way (#2103, Thomas Dickey).

X11R6.7 incorporated the XFree86 changes, and thus X11R6.7 and later releases
from X.Org are not vulnerable.

[1] http://lists.freedesktop.org/archives/xorg-announce/2012-July/002040.html

Statement:

Not vulnerable. This issue did not affect the versions of xorg-x11-xfs as shipped with Red Hat Enterprise Linux 5.  It does not affect Red Hat Enterprise Linux 6 as it no longer uses or provides the XFS font server.
Note You need to log in before you can comment on or make changes to this bug.