[ASA-202012-6] xorg-server: arbitrary code execution
Remi Gacogne
rgacogne at archlinux.org
Wed Dec 9 18:58:02 UTC 2020
Arch Linux Security Advisory ASA-202012-6
=========================================
Severity: Medium
Date : 2020-12-05
CVE-ID : CVE-2020-14360 CVE-2020-25712
Package : xorg-server
Type : arbitrary code execution
Remote : No
Link : https://security.archlinux.org/AVG-1310
Summary
=======
The package xorg-server before version 1.20.10-1 is vulnerable to
arbitrary code execution.
Resolution
==========
Upgrade to 1.20.10-1.
# pacman -Syu "xorg-server>=1.20.10-1"
The problems have been fixed upstream in version 1.20.10.
Workaround
==========
None.
Description
===========
- CVE-2020-14360 (arbitrary code execution)
A security issue was discovered in xorg-server before 1.20.10.
Insufficient checks on the lengths of the XkbSetMap request can lead to
out of bounds memory accesses in the X server. This issue can lead to
privilege escalation for authorized clients on systems where the X
server is running privileged.
- CVE-2020-25712 (arbitrary code execution)
A security issue was discovered in xorg-server before 1.20.10.
Insufficient checks on input of the XkbSetDeviceInfo request can lead
to a buffer overflow on the head in the X server. This issue can lead
to privilege escalation for authorized clients on systems where the X
server is running privileged.
Impact
======
A local attacker might be able to escalate privileges.
References
==========
https://www.openwall.com/lists/oss-security/2020/12/01/3
https://gitlab.freedesktop.org/xorg/xserver/-/commit/446ff2d3177087b8173fa779fa5b77a2a128988b
https://gitlab.freedesktop.org/xorg/xserver/-/commit/87c64fc5b0db9f62f4e361444f4b60501ebf67b9
https://security.archlinux.org/CVE-2020-14360
https://security.archlinux.org/CVE-2020-25712
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x46EC46F39F3E2EF1.asc
Type: application/pgp-keys
Size: 9534 bytes
Desc: not available
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20201209/b5d36c00/attachment-0001.bin>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20201209/b5d36c00/attachment-0001.sig>
More information about the arch-security
mailing list