Bug 959040 (CVE-2013-1981) - CVE-2013-1981 libX11: Multiple integer overflows leading to heap-based buffer-overflows
Summary: CVE-2013-1981 libX11: Multiple integer overflows leading to heap-based buffer...
Alias: CVE-2013-1981
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 966680 1078019
Blocks: 959130 1101912
TreeView+ depends on / blocked
Reported: 2013-05-03 04:32 UTC by Huzaifa S. Sidhpurwala
Modified: 2021-02-17 07:44 UTC (History)
5 users (show)

Fixed In Version: libX11 (1.6 RC2)
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-10-16 06:02:56 UTC

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1436 0 normal SHIPPED_LIVE Moderate: X11 client libraries security, bug fix, and enhancement update 2014-10-14 01:06:02 UTC

Description Huzaifa S. Sidhpurwala 2013-05-03 04:32:21 UTC
Several integer overflow flaws causing heap-based buffer overflows were found in libX11, the Core X11 protocol client library. 

Note from upstream:

Most of these issues stem from the client libraries trusting the server to send correct protocol data, and not verifying that the values will not overflow or cause other damage.   Most of the time X clients & servers are run by the same user, with the server more privileged from the clients, so this is not a problem, but there are scenarios in which a privileged client can be connected to an unprivileged server, for instance, connecting a setuid X client (such as a screen lock program) to a virtual X server(such as Xvfb or Xephyr) the user has modified to return invalid data, potentially allowing the user to escalate their privileges.

Comment 18 Vincent Danen 2013-05-09 21:51:10 UTC
Affects libX11 (1.6 RC1) and earlier

Integer overflows calculating memory needs for replies:

Affected functions:  XQueryFont(), _XF86BigfontQueryFont(), XListFontsWithInfo(), XGetMotionEvents(), XListHosts(), XGetModifierMapping(), XGetPointerMapping(), XGetKeyboardMapping(), XGetWindowProperty(), XGetImage()

Integer overflows parsing user-specified files:

Affected functions:  LoadColornameDB(), XrmGetFileDatabase(), _XimParseStringFile(), TransFileName()

Comment 19 Jan Lieskovsky 2013-05-23 15:25:42 UTC
Public via:

Comment 20 Jan Lieskovsky 2013-05-23 16:18:57 UTC
Upstream patches:


  Patches for issues:
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=6df8a63d34b7514077188e2062a13774f920c085 [1/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=5669a220816b7d58fcaf0c302ead16fbe5c87817 [2/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=39515b7c3ba8cae9021bf6695e378ae19487082f [3/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=1f6a3dbf699b85c0ea715ef21de7e7095a714e12 [4/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=2cd62b5eb99ffbb2fce99f3c459455e630b35bf7 [5/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=90fd5abac2faca86f9f100353a3c9c7b89f31484 [6/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=076428918e6c35f66b9b55c3fa097ff06496d155 [7/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=460e8a223b87d4fa0ea1e97823e998a770e0f2a2 [8/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=164bf4dfe839b1cc75cdeee378a243d04a8200e4 [9/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=79d8dc08eb98842173ce239b9dd60df0e9e9ae72 [10/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=833f6b70bc789d33607f6dbfee9e0a4178ec4b59 [11/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=a351b8103b2ba78882e1c309e85893ca3abe2073 [12/13]
  http://cgit.freedesktop.org/xorg/lib/libX11/commit/?id=0b0f5d4358c3de7563d6af03f0d2ce454702a06a [13/13]

Comment 21 Jan Lieskovsky 2013-05-23 16:24:28 UTC
These issues affects the versions of the libX11 packages, as shipped with Fedora release of 17 and 18. Please schedule an update.

Comment 22 Jan Lieskovsky 2013-05-23 16:38:11 UTC
Created libX11 tracking bugs for this issue

Affects: fedora-all [bug 966680]

Comment 23 Jan Lieskovsky 2013-05-23 17:00:58 UTC
External References:


Comment 24 Fedora Update System 2013-05-27 03:27:07 UTC
libX11- has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 25 Fedora Update System 2013-05-28 01:02:43 UTC
libX11- has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 26 Peter Hutterer 2013-05-28 03:04:05 UTC
All packages in stable, closing.

Comment 28 Huzaifa S. Sidhpurwala 2013-06-05 03:30:38 UTC
This issue affects the version of libX11 as shipped with Red Hat Enterprise Linux 5 and 6.

Comment 29 Huzaifa S. Sidhpurwala 2013-06-05 03:45:30 UTC

This issue affects the libX11 package in Red Hat Enterprise Linux 5. Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not planned to be fixed in Red Hat Enterprise Linux 5 as it is now in Production 3 Phase of the support and maintenance life cycle: https://access.redhat.com/support/policy/updates/errata/

Comment 31 errata-xmlrpc 2014-10-14 05:04:58 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1436 https://rhn.redhat.com/errata/RHSA-2014-1436.html

Note You need to log in before you can comment on or make changes to this bug.