[arch-security] [ASA-201708-11] xorg-server: multiple issues

[Remi Gacogne]

Arch Linux Security Advisory ASA-201708-11
==========================================

Severity: High
Date    : 2017-08-14
CVE-ID  : CVE-2017-10971 CVE-2017-10972
Package : xorg-server
Type    : multiple issues
Remote  : Yes
Link    : https://security.archlinux.org/AVG-341

Summary
=======

The package xorg-server before version 1.19.3-3 is vulnerable to
multiple issues including arbitrary code execution and information
disclosure.

Resolution
==========

Upgrade to 1.19.3-3.

# pacman -Syu "xorg-server>=1.19.3-3"

The problems have been fixed upstream but no release is available yet.

Workaround
==========

None.

Description
===========

- CVE-2017-10971 (arbitrary code execution)

In the X.Org X server on v.1.19.3, a user authenticated to an X Session
could crash or execute code in the context of the X Server by
exploiting a stack overflow in the endianness conversion of X Events.

- CVE-2017-10972 (information disclosure)

Uninitialized data in endianness conversion in the XEvent handling of
the X.Org X Server on v1.19.3 and before allowed authenticated
malicious users to access potentially privileged data from the X
server.

Impact
======

A remote attacker can access sensitive information or execute arbitrary
code on the affected host.

References
==========

https://bugzilla.suse.com/show_bug.cgi?id=1035283
https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b107d84524e700d2073c
https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992edcfd282cbeeec35d9d
https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455
https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1a00eca3ffc5489ced
https://security.archlinux.org/CVE-2017-10971
https://security.archlinux.org/CVE-2017-10972

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20170815/44e2222f/attachment.asc>