[arch-security] [ASA-201412-14] xorg-server: multiple issues

[Levente Polyak]

Arch Linux Security Advisory ASA-201412-14
==========================================

Severity: Critical
Date    : 2014-12-12
CVE-ID  : CVE-2014-8091 CVE-2014-8092 CVE-2014-8093 CVE-2014-8094
          CVE-2014-8095 CVE-2014-8096 CVE-2014-8097 CVE-2014-8098
          CVE-2014-8099 CVE-2014-8100 CVE-2014-8101 CVE-2014-8102
          CVE-2014-8103
Package : xorg-server
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/index.php/CVE-2014

Summary
=======

The package xorg-server before version 1.16.2.901-1 is vulnerable to
multiple issues including but not limited to denial of service and
possibly arbitrary code execution.

Resolution
==========

Upgrade to 1.16.2.901-1.

# pacman -Syu "xorg-server>=1.16.2.901-1"

The problems have been fixed upstream in version 1.16.2.901.

Workaround
==========

None.

Description
===========

- CVE-2014-8091 (denial of service)
X.Org X Window System, when using SUN-DES-1 (Secure RPC) authentication
credentials, does not check the return value of a malloc call, which
allows remote attackers to cause a denial of service (NULL pointer
dereference and server crash) via a crafted connection request.

- CVE-2014-8092 (arbitrary code execution)
A flaw allow remote authenticated users to cause a denial of service or
possibly execute arbitrary code via a crafted request to various
affected functions, which triggers an out-of-bounds read or write.

- CVE-2014-8093 (arbitrary code execution)
Multiple integer overflows allow remote authenticated users to cause a
denial of service or possibly execute arbitrary code via a crafted
request to various affected functions, which triggers an out-of-bounds
read or write.

- CVE-2014-8094 (arbitrary code execution)
Integer overflow in the ProcDRI2GetBuffers function in the DRI2
extension allows remote authenticated users to cause a denial of service
or possibly execute arbitrary code via a crafted request, which triggers
an out-of-bounds read or write.

- CVE-2014-8095 (arbitrary code execution)
The XInput extension allows remote authenticated users to cause a denial
of service (out-of-bounds read or write) or possibly execute arbitrary
code via a crafted length or index value to various affected functions.

- CVE-2014-8096 (arbitrary code execution)
The SProcXCMiscGetXIDList function in the XC-MISC extension allows
remote authenticated users to cause a denial of service (out-of-bounds
read or write) or possibly execute arbitrary code via a crafted length
or index value.

- CVE-2014-8097 (arbitrary code execution)
The DBE extension allows remote authenticated users to cause a denial of
service (out-of-bounds read or write) or possibly execute arbitrary code
via a crafted length or index value to various affected functions.

- CVE-2014-8098 (arbitrary code execution)
The GLX extension allows remote authenticated users to cause a denial of
service (out-of-bounds read or write) or possibly execute arbitrary code
via a crafted length or index value to various affected functions.

- CVE-2014-8099 (arbitrary code execution)
The XVideo extension allows remote authenticated users to cause a denial
of service (out-of-bounds read or write) or possibly execute arbitrary
code via a crafted length or index value to various affected function.

- CVE-2014-8100 (arbitrary code execution)
The Render extension allows remote authenticated users to cause a denial
of service (out-of-bounds read or write) or possibly execute arbitrary
code via a crafted length or index value to various affected functions.

- CVE-2014-8101 (arbitrary code execution)
The RandR extension allows remote authenticated users to cause a denial
of service (out-of-bounds read or write) or possibly execute arbitrary
code via a crafted length or index value to various affected functions.

- CVE-2014-8102 (arbitrary code execution)
The SProcXFixesSelectSelectionInput function in the XFixes extension
allows remote authenticated users to cause a denial of service
(out-of-bounds read or write) or possibly execute arbitrary code via a
crafted length value.

- CVE-2014-8103 (arbitrary code execution)
A flaw allows remote authenticated users to cause a denial of service
(out-of-bounds read or write) or possibly execute arbitrary code via a
crafted length or index value to various affected functions in the DRI3
or Present extension.

Impact
======

An authenticated attacker, either locally or remotely, is able to cause
a denial of service or possibly execute arbitrary code via crafted calls
to various affected functions.

References
==========

http://www.x.org/wiki/Development/Security/Advisory-2014-12-09/
http://lists.x.org/archives/xorg-announce/2014-December/002501.html
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8091
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8092
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8093
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8094
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8095
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8096
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8097
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8098
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8099
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8100
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8101
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8102
https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8103

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20141212/7673f1fc/attachment.bin>