[arch-security] [ASA-201710-29] xorg-server: arbitrary code execution
rgacogne at archlinux.org
Sat Oct 21 19:38:32 UTC 2017
Arch Linux Security Advisory ASA-201710-29
Date : 2017-10-21
CVE-ID : CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12183
Package : xorg-server
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-443
The package xorg-server before version 1.19.5-1 is vulnerable to
arbitrary code execution.
Upgrade to 1.19.5-1.
# pacman -Syu "xorg-server>=1.19.5-1"
The problems have been fixed upstream in version 1.19.5.
- CVE-2017-12176 (arbitrary code execution)
A security issue has been found in xorg-server, due to a missing
validation of the extra length in ProcEstablishConnection().
- CVE-2017-12177 (arbitrary code execution)
A security issue has been found in the double buffer extension
component of xorg-server, due to a missing validation of the length of
a variable-length request in ProcDbeGetVisualInfo().
- CVE-2017-12178 (arbitrary code execution)
A security issue has been found in the Xi component of xorg-server, due
to an invalid length check in ProcXIChangeHierarchy.
- CVE-2017-12183 (arbitrary code execution)
A security issue has been found in the xfixes component of xorg-server,
where buffer lengths were not correctly validated.
An attacker able to connect to an X server, either locally or remotely,
can cause a denial of service by crashing the server, or execute
arbitrary code on the affected host.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 833 bytes
Desc: OpenPGP digital signature
More information about the arch-security