[arch-security] [ASA-201710-29] xorg-server: arbitrary code execution

[Remi Gacogne]

Arch Linux Security Advisory ASA-201710-29
==========================================

Severity: High
Date    : 2017-10-21
CVE-ID  : CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12183
Package : xorg-server
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-443

Summary
=======

The package xorg-server before version 1.19.5-1 is vulnerable to
arbitrary code execution.

Resolution
==========

Upgrade to 1.19.5-1.

# pacman -Syu "xorg-server>=1.19.5-1"

The problems have been fixed upstream in version 1.19.5.

Workaround
==========

None.

Description
===========

- CVE-2017-12176 (arbitrary code execution)

A security issue has been found in xorg-server, due to a missing
validation of the extra length in ProcEstablishConnection().

- CVE-2017-12177 (arbitrary code execution)

A security issue has been found in the double buffer extension
component of xorg-server, due to a missing validation of the length of
a variable-length request in ProcDbeGetVisualInfo().

- CVE-2017-12178 (arbitrary code execution)

A security issue has been found in the Xi component of xorg-server, due
to an invalid length check in ProcXIChangeHierarchy.

- CVE-2017-12183 (arbitrary code execution)

A security issue has been found in the xfixes component of xorg-server,
where buffer lengths were not correctly validated.

Impact
======

An attacker able to connect to an X server, either locally or remotely,
can cause a denial of service by crashing the server, or execute
arbitrary code on the affected host.

References
==========

https://lists.x.org/archives/xorg-devel/2017-October/054871.html
https://cgit.freedesktop.org/xorg/xserver/commit/?id=b747da5e25be944337a9cd1415506fc06b70aa81
https://cgit.freedesktop.org/xorg/xserver/commit/?id=4ca68b878e851e2136c234f40a25008297d8d831
https://cgit.freedesktop.org/xorg/xserver/commit/?id=859b08d523307eebde7724fd1a0789c44813e821
https://cgit.freedesktop.org/xorg/xserver/commit/?id=55caa8b08c84af2b50fbc936cf334a5a93dd7db5
https://security.archlinux.org/CVE-2017-12176
https://security.archlinux.org/CVE-2017-12177
https://security.archlinux.org/CVE-2017-12178
https://security.archlinux.org/CVE-2017-12183

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20171021/b12658b8/attachment.asc>