Описание
Security update for xorg-x11-server
This update for xorg-x11-server provides several fixes.
These security issues were fixed:
- CVE-2017-13723: Prevent local DoS via unusual characters in XkbAtomText and XkbStringText (bsc#1051150).
- Improve the entropy when generating random data used in X.org server authorization cookies generation by using getentropy() and getrandom() when available (bsc#1025084)
- CVE-2017-12184,CVE-2017-12185,CVE-2017-12186,CVE-2017-12187: Fixed unvalidated lengths in multiple extensions (bsc#1063034)
- CVE-2017-12183: Fixed some unvalidated lengths in the XFIXES extension. (bsc#1063035)
- CVE-2017-12180,CVE-2017-12181,CVE-2017-12182: Fixed various unvalidated lengths in the XFree86-VidMode/XFree86-DGA/XFree86-DRI extensions (bsc#1063037)
- CVE-2017-12179: Fixed an integer overflow and unvalidated length in (S)ProcXIBarrierReleasePointer in Xi (bsc#1063038)
- CVE-2017-12178: Fixed a wrong extra length check in ProcXIChangeHierarchy in Xi (bsc#1063039)
- CVE-2017-12177: Fixed an unvalidated variable-length request in ProcDbeGetVisualInfo (bsc#1063040)
- CVE-2017-12176: Fixed an unvalidated extra length in ProcEstablishConnection (bsc#1063041)
Список пакетов
SUSE Linux Enterprise Server 11 SP4
SUSE Linux Enterprise Server for SAP Applications 11 SP4
SUSE Linux Enterprise Software Development Kit 11 SP4
Ссылки
- Link for SUSE-SU-2017:3025-1
- E-Mail link for SUSE-SU-2017:3025-1
- SUSE Security Ratings
- SUSE Bug 1025084
- SUSE Bug 1051150
- SUSE Bug 1063034
- SUSE Bug 1063035
- SUSE Bug 1063037
- SUSE Bug 1063038
- SUSE Bug 1063039
- SUSE Bug 1063040
- SUSE Bug 1063041
- SUSE CVE CVE-2017-12176 page
- SUSE CVE CVE-2017-12177 page
- SUSE CVE CVE-2017-12178 page
- SUSE CVE CVE-2017-12179 page
- SUSE CVE CVE-2017-12180 page
- SUSE CVE CVE-2017-12181 page
- SUSE CVE CVE-2017-12182 page
- SUSE CVE CVE-2017-12183 page
Описание
xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12176
- SUSE Bug 1063041
Описание
xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12177
- SUSE Bug 1063040
Описание
xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12178
- SUSE Bug 1063039
Описание
xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12179
- SUSE Bug 1063038
Описание
xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12180
- SUSE Bug 1063037
Описание
xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12181
- SUSE Bug 1063037
Описание
xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12182
- SUSE Bug 1063037
Описание
xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12183
- SUSE Bug 1063035
Описание
xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12184
- SUSE Bug 1063034
Описание
xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12185
- SUSE Bug 1063034
Описание
xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12186
- SUSE Bug 1063034
Описание
xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.
Затронутые продукты
Ссылки
- CVE-2017-12187
- SUSE Bug 1063034
Описание
In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.
Затронутые продукты
Ссылки
- CVE-2017-13723
- SUSE Bug 1051150
- SUSE Bug 1052984