Arch Linux Security Advisory ASA-202012-6 ========================================= Severity: Medium Date : 2020-12-05 CVE-ID : CVE-2020-14360 CVE-2020-25712 Package : xorg-server Type : arbitrary code execution Remote : No Link : https://security.archlinux.org/AVG-1310 Summary ======= The package xorg-server before version 1.20.10-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.20.10-1. # pacman -Syu "xorg-server>=1.20.10-1" The problems have been fixed upstream in version 1.20.10. Workaround ========== None. Description =========== - CVE-2020-14360 (arbitrary code execution) A security issue was discovered in xorg-server before 1.20.10. Insufficient checks on the lengths of the XkbSetMap request can lead to out of bounds memory accesses in the X server. This issue can lead to privilege escalation for authorized clients on systems where the X server is running privileged. - CVE-2020-25712 (arbitrary code execution) A security issue was discovered in xorg-server before 1.20.10. Insufficient checks on input of the XkbSetDeviceInfo request can lead to a buffer overflow on the head in the X server. This issue can lead to privilege escalation for authorized clients on systems where the X server is running privileged. Impact ====== A local attacker might be able to escalate privileges. References ========== https://www.openwall.com/lists/oss-security/2020/12/01/3 https://gitlab.freedesktop.org/xorg/xserver/-/commit/446ff2d3177087b8173fa77... https://gitlab.freedesktop.org/xorg/xserver/-/commit/87c64fc5b0db9f62f4e3614... https://security.archlinux.org/CVE-2020-14360 https://security.archlinux.org/CVE-2020-25712