Red Hat Bugzilla – Bug 959040
CVE-2013-1981 libX11: Multiple integer overflows leading to heap-based buffer-overflows
Last modified: 2014-10-17 03:36:01 EDT
Several integer overflow flaws causing heap-based buffer overflows were found in libX11, the Core X11 protocol client library. Note from upstream: Most of these issues stem from the client libraries trusting the server to send correct protocol data, and not verifying that the values will not overflow or cause other damage. Most of the time X clients & servers are run by the same user, with the server more privileged from the clients, so this is not a problem, but there are scenarios in which a privileged client can be connected to an unprivileged server, for instance, connecting a setuid X client (such as a screen lock program) to a virtual X server(such as Xvfb or Xephyr) the user has modified to return invalid data, potentially allowing the user to escalate their privileges.
Affects libX11 1.5.99.901 (1.6 RC1) and earlier Integer overflows calculating memory needs for replies: Affected functions: XQueryFont(), _XF86BigfontQueryFont(), XListFontsWithInfo(), XGetMotionEvents(), XListHosts(), XGetModifierMapping(), XGetPointerMapping(), XGetKeyboardMapping(), XGetWindowProperty(), XGetImage() Integer overflows parsing user-specified files: Affected functions: LoadColornameDB(), XrmGetFileDatabase(), _XimParseStringFile(), TransFileName()
Public via: http://www.openwall.com/lists/oss-security/2013/05/23/3
Upstream patches: Prerequisite: http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=d7f04c340ade3834e603c23d543132e1ee4e0c63 http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=9f5d83706543696fc944c1835a403938c06f2cc5 Patches for issues: http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=6df8a63d34b7514077188e2062a13774f920c085 [1/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=5669a220816b7d58fcaf0c302ead16fbe5c87817 [2/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=39515b7c3ba8cae9021bf6695e378ae19487082f [3/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=1f6a3dbf699b85c0ea715ef21de7e7095a714e12 [4/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=2cd62b5eb99ffbb2fce99f3c459455e630b35bf7 [5/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=90fd5abac2faca86f9f100353a3c9c7b89f31484 [6/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=076428918e6c35f66b9b55c3fa097ff06496d155 [7/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=460e8a223b87d4fa0ea1e97823e998a770e0f2a2 [8/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=164bf4dfe839b1cc75cdeee378a243d04a8200e4 [9/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=79d8dc08eb98842173ce239b9dd60df0e9e9ae72 [10/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=833f6b70bc789d33607f6dbfee9e0a4178ec4b59 [11/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=a351b8103b2ba78882e1c309e85893ca3abe2073 [12/13] http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=0b0f5d4358c3de7563d6af03f0d2ce454702a06a [13/13]
These issues affects the versions of the libX11 packages, as shipped with Fedora release of 17 and 18. Please schedule an update.
Created libX11 tracking bugs for this issue Affects: fedora-all [bug 966680]
External References: http://www.x.org/wiki/Development/Security/Advisory-2013-05-23
libX11-1.5.99.901-3.20130524gita3bdd2b09.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
libX11-1.5.99.901-3.20130524gita3bdd2b09.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
All packages in stable, closing.
This issue affects the version of libX11 as shipped with Red Hat Enterprise Linux 5 and 6.
Statement: This issue affects the libX11 package in Red Hat Enterprise Linux 5. Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle: https://access.redhat.com/support/policy/updates/errata/
This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2014:1436 https://rhn.redhat.com/errata/RHSA-2014-1436.html