Arch Linux Security Advisory ASA-201708-11 ========================================== Severity: High Date : 2017-08-14 CVE-ID : CVE-2017-10971 CVE-2017-10972 Package : xorg-server Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-341 Summary ======= The package xorg-server before version 1.19.3-3 is vulnerable to multiple issues including arbitrary code execution and information disclosure. Resolution ========== Upgrade to 1.19.3-3. # pacman -Syu "xorg-server>=1.19.3-3" The problems have been fixed upstream but no release is available yet. Workaround ========== None. Description =========== - CVE-2017-10971 (arbitrary code execution) In the X.Org X server on v.1.19.3, a user authenticated to an X Session could crash or execute code in the context of the X Server by exploiting a stack overflow in the endianness conversion of X Events. - CVE-2017-10972 (information disclosure) Uninitialized data in endianness conversion in the XEvent handling of the X.Org X Server on v1.19.3 and before allowed authenticated malicious users to access potentially privileged data from the X server. Impact ====== A remote attacker can access sensitive information or execute arbitrary code on the affected host. References ========== https://bugzilla.suse.com/show_bug.cgi?id=1035283 https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b10... https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992ed... https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b13648696... https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1... https://security.archlinux.org/CVE-2017-10971 https://security.archlinux.org/CVE-2017-10972