Arch Linux Security Advisory ASA-201412-14 ========================================== Severity: Critical Date : 2014-12-12 CVE-ID : CVE-2014-8091 CVE-2014-8092 CVE-2014-8093 CVE-2014-8094 CVE-2014-8095 CVE-2014-8096 CVE-2014-8097 CVE-2014-8098 CVE-2014-8099 CVE-2014-8100 CVE-2014-8101 CVE-2014-8102 CVE-2014-8103 Package : xorg-server Type : multiple issues Remote : Yes Link : https://wiki.archlinux.org/index.php/CVE-2014 Summary ======= The package xorg-server before version 1.16.2.901-1 is vulnerable to multiple issues including but not limited to denial of service and possibly arbitrary code execution. Resolution ========== Upgrade to 1.16.2.901-1. # pacman -Syu "xorg-server>=1.16.2.901-1" The problems have been fixed upstream in version 1.16.2.901. Workaround ========== None. Description =========== - CVE-2014-8091 (denial of service) X.Org X Window System, when using SUN-DES-1 (Secure RPC) authentication credentials, does not check the return value of a malloc call, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a crafted connection request. - CVE-2014-8092 (arbitrary code execution) A flaw allow remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted request to various affected functions, which triggers an out-of-bounds read or write. - CVE-2014-8093 (arbitrary code execution) Multiple integer overflows allow remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted request to various affected functions, which triggers an out-of-bounds read or write. - CVE-2014-8094 (arbitrary code execution) Integer overflow in the ProcDRI2GetBuffers function in the DRI2 extension allows remote authenticated users to cause a denial of service or possibly execute arbitrary code via a crafted request, which triggers an out-of-bounds read or write. - CVE-2014-8095 (arbitrary code execution) The XInput extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8096 (arbitrary code execution) The SProcXCMiscGetXIDList function in the XC-MISC extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value. - CVE-2014-8097 (arbitrary code execution) The DBE extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8098 (arbitrary code execution) The GLX extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8099 (arbitrary code execution) The XVideo extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected function. - CVE-2014-8100 (arbitrary code execution) The Render extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8101 (arbitrary code execution) The RandR extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions. - CVE-2014-8102 (arbitrary code execution) The SProcXFixesSelectSelectionInput function in the XFixes extension allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length value. - CVE-2014-8103 (arbitrary code execution) A flaw allows remote authenticated users to cause a denial of service (out-of-bounds read or write) or possibly execute arbitrary code via a crafted length or index value to various affected functions in the DRI3 or Present extension. Impact ====== An authenticated attacker, either locally or remotely, is able to cause a denial of service or possibly execute arbitrary code via crafted calls to various affected functions. References ========== http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/ http://lists.x.org/archives/xorg-announce/2014-December/002501.html https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8091 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8092 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8093 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8094 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8095 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8096 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8097 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8098 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8099 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8100 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8101 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8102 https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8103