[ MDKSA-2007:079-1 ] - Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities

To: bugtraq@xxxxxxxxxxxxxxxxx
Subject: [ MDKSA-2007:079-1 ] - Updated xorg-x11/XFree86 packages fix integer overflow vulnerabilities
From: security@xxxxxxxxxxxx
Date: Wed, 11 Apr 2007 13:02:54 -0600
List-help: <mailto:bugtraq-help@securityfocus.com>
List-id: <bugtraq.list-id.securityfocus.com>
List-post: <mailto:bugtraq@securityfocus.com>
List-subscribe: <mailto:bugtraq-subscribe@securityfocus.com>
List-unsubscribe: <mailto:bugtraq-unsubscribe@securityfocus.com>
Mailing-list: contact bugtraq-help@xxxxxxxxxxxxxxxxx; run by ezmlm
Reply-to: <xsecurity@xxxxxxxxxxxx>
Sender: QA Team <qateam@xxxxxxxxxxxxxxxxx>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                       MDKSA-2007:079-1
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : xorg-x11
 Date    : April 11, 2007
 Affected: 2007.1
 _______________________________________________________________________
 
 Problem Description:
 
 Local exploitation of a memory corruption vulnerability in the X.Org
 and XFree86 X server could allow an attacker to execute arbitrary
 code with privileges of the X server, typically root.
 
 The vulnerability exists in the ProcXCMiscGetXIDList() function in the
 XC-MISC extension. This request is used to determine what resource IDs
 are available for use. This function contains two vulnerabilities,
 both result in memory corruption of either the stack or heap. The
 ALLOCATE_LOCAL() macro used by this function allocates memory on the
 stack using alloca() on systems where alloca() is present, or using
 the heap otherwise. The handler function takes a user provided value,
 multiplies it, and then passes it to the above macro. This results in
 both an integer overflow vulnerability, and an alloca() stack pointer
 shifting vulnerability. Both can be exploited to execute arbitrary
 code. (CVE-2007-1003)
 
 iDefense reported two integer overflows in the way X.org handled
 various font files. A malicious local user could exploit these issues
 to potentially execute arbitrary code with the privileges of the
 X.org server. (CVE-2007-1351, CVE-2007-1352)
 
 Multiple integer overflows in (1) the XGetPixel function in ImUtil.c
 in x.org libx11 before 1.0.3, and (2) XInitImage function in xwd.c for
 ImageMagick, allow user-assisted remote attackers to cause a denial
 of service (crash) or information leak via crafted images with large
 or negative values that trigger a buffer overflow. (CVE-2007-1667)
 
 Updated packages are patched to address these issues.

 Update:

 Packages for Mandriva Linux 2007.1 are now available.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1003
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1667
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.1:
 094834b9cec06d41814fcfbb4826a1b4  
2007.1/i586/libx11-common-1.1.1-2.1mdv2007.1.i586.rpm
 60ba6ee2def612bab83b056aa9143c28  
2007.1/i586/libx11_6-1.1.1-2.1mdv2007.1.i586.rpm
 83832a8b9a359f0199bf0b58024bcc93  
2007.1/i586/libx11_6-devel-1.1.1-2.1mdv2007.1.i586.rpm
 e7f0426150c15b701dca49a131d4f911  
2007.1/i586/libx11_6-static-devel-1.1.1-2.1mdv2007.1.i586.rpm
 4d737b55208b15a17076ea417fef6e83  
2007.1/i586/libxfont1-1.2.7-1.1mdv2007.1.i586.rpm
 28b347acb8851ef8cdc9b8b61ffb669b  
2007.1/i586/libxfont1-devel-1.2.7-1.1mdv2007.1.i586.rpm
 aa2e50b1ee6967c2ed3bb8c6dc64c84b  
2007.1/i586/libxfont1-static-devel-1.2.7-1.1mdv2007.1.i586.rpm
 530b51e76f6b9a0df342719a8b9ddb99  
2007.1/i586/x11-server-1.2.0-8.1mdv2007.1.i586.rpm
 9d717cb5fab234a4c76a4a0811bf4638  
2007.1/i586/x11-server-common-1.2.0-8.1mdv2007.1.i586.rpm
 5a47c5a19827c3e820b02c2db7796659  
2007.1/i586/x11-server-devel-1.2.0-8.1mdv2007.1.i586.rpm
 76a33d69862b1c457a2cec21a37b51d8  
2007.1/i586/x11-server-xati-1.2.0-8.1mdv2007.1.i586.rpm
 880f19417b5379635ddb6c5f2e612971  
2007.1/i586/x11-server-xchips-1.2.0-8.1mdv2007.1.i586.rpm
 dc8db2e2fa639a5e5590a9301590e58a  
2007.1/i586/x11-server-xdmx-1.2.0-8.1mdv2007.1.i586.rpm
 b71ce20ae5de448b2e54d6458df98526  
2007.1/i586/x11-server-xephyr-1.2.0-8.1mdv2007.1.i586.rpm
 fed1ade3cb4ca74c6362837618a5452c  
2007.1/i586/x11-server-xepson-1.2.0-8.1mdv2007.1.i586.rpm
 9e3f8d012b49126ee4b217dd24521f29  
2007.1/i586/x11-server-xfake-1.2.0-8.1mdv2007.1.i586.rpm
 15adb208aac159c1575a3ddd77ffbaee  
2007.1/i586/x11-server-xfbdev-1.2.0-8.1mdv2007.1.i586.rpm
 37b8f6fdbfca1dc9192758dabd9b5adc  
2007.1/i586/x11-server-xgl-0.0.1-0.20070105.4.1mdv2007.1.i586.rpm
 f8a04c4056025562b4e280a09c5c8577  
2007.1/i586/x11-server-xi810-1.2.0-8.1mdv2007.1.i586.rpm
 ce53fc038ab1f432b216d4057e53057d  
2007.1/i586/x11-server-xmach64-1.2.0-8.1mdv2007.1.i586.rpm
 a6fe363ba43b509661709a3c9245ba8c  
2007.1/i586/x11-server-xmga-1.2.0-8.1mdv2007.1.i586.rpm
 d95d4a1b0b7e9bdee00f7cf90e934a39  
2007.1/i586/x11-server-xneomagic-1.2.0-8.1mdv2007.1.i586.rpm
 7718f0eabcc0b212012ffb0e5c8e6a26  
2007.1/i586/x11-server-xnest-1.2.0-8.1mdv2007.1.i586.rpm
 5c06fbc05c7ea8abfdb4ecdeb2ce2d75  
2007.1/i586/x11-server-xnvidia-1.2.0-8.1mdv2007.1.i586.rpm
 aa416e9d9cc207be2c801c4570d43015  
2007.1/i586/x11-server-xorg-1.2.0-8.1mdv2007.1.i586.rpm
 9076d8da47cfa869a84896cd26722ecc  
2007.1/i586/x11-server-xpm2-1.2.0-8.1mdv2007.1.i586.rpm
 b6c9e9c76bfb9ad237fff6b4c2ce2e04  
2007.1/i586/x11-server-xprt-1.2.0-8.1mdv2007.1.i586.rpm
 dcaf5905ffdd594ac3b97aa1b94baae6  
2007.1/i586/x11-server-xr128-1.2.0-8.1mdv2007.1.i586.rpm
 770630c3643c095ba99d8fbd838bf148  
2007.1/i586/x11-server-xsdl-1.2.0-8.1mdv2007.1.i586.rpm
 57c93b2b5f8e289063dc5bd678a15e17  
2007.1/i586/x11-server-xsmi-1.2.0-8.1mdv2007.1.i586.rpm
 8e26db22cbba03a68962ecaa7f0f40d0  
2007.1/i586/x11-server-xvesa-1.2.0-8.1mdv2007.1.i586.rpm
 caa3a31e61065af8dd25b8f115657910  
2007.1/i586/x11-server-xvfb-1.2.0-8.1mdv2007.1.i586.rpm
 f5baee2c239e4b9d5f5c1e0d0ae64ddd  
2007.1/i586/x11-server-xvia-1.2.0-8.1mdv2007.1.i586.rpm
 1be993d23f79ba6356b7dfcb0dd36b44  
2007.1/i586/x11-server-xvnc-1.2.0-8.1mdv2007.1.i586.rpm 
 aeba38426c094f892a8db7c56ed8c301  
2007.1/SRPMS/libx11-1.1.1-2.1mdv2007.1.src.rpm
 0e7061bca9907c2b0eca9dacdab4403c  
2007.1/SRPMS/libxfont-1.2.7-1.1mdv2007.1.src.rpm
 4f8be7e1843b036a3368f13d4d6a964b  
2007.1/SRPMS/x11-server-1.2.0-8.1mdv2007.1.src.rpm
 3771f05b9e14a04e41905e6d145d0c41  
2007.1/SRPMS/x11-server-xgl-0.0.1-0.20070105.4.1mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 a8e9b831949d99880f61e496fcda81fa  
2007.1/x86_64/lib64x11_6-1.1.1-2.1mdv2007.1.x86_64.rpm
 8a2cdcf52cb086a7ec479585f4615aff  
2007.1/x86_64/lib64x11_6-devel-1.1.1-2.1mdv2007.1.x86_64.rpm
 9a3f679f360cf576598f3bd2058b441c  
2007.1/x86_64/lib64x11_6-static-devel-1.1.1-2.1mdv2007.1.x86_64.rpm
 38588291d4baf93d53f2cacfc91470fc  
2007.1/x86_64/lib64xfont1-1.2.7-1.1mdv2007.1.x86_64.rpm
 08a34ff0e3a6a6c25beaef8b5f4d6dbf  
2007.1/x86_64/lib64xfont1-devel-1.2.7-1.1mdv2007.1.x86_64.rpm
 0709d442ee2fdc7134abb5d1a71afab1  
2007.1/x86_64/lib64xfont1-static-devel-1.2.7-1.1mdv2007.1.x86_64.rpm
 ee41dd9b5381466727456905d4c2b29a  
2007.1/x86_64/libx11-common-1.1.1-2.1mdv2007.1.x86_64.rpm
 99fdfc64834e47ed1efc35796f1da887  
2007.1/x86_64/x11-server-1.2.0-8.1mdv2007.1.x86_64.rpm
 47570e6070fc356fe3213d5787990a1c  
2007.1/x86_64/x11-server-common-1.2.0-8.1mdv2007.1.x86_64.rpm
 deb1c9a780b5789f71c7b3bc23c24f2c  
2007.1/x86_64/x11-server-devel-1.2.0-8.1mdv2007.1.x86_64.rpm
 21d5e1148cc503e47a135fad2cf10257  
2007.1/x86_64/x11-server-xdmx-1.2.0-8.1mdv2007.1.x86_64.rpm
 500a8bb735d0cdda28044f85d436ea64  
2007.1/x86_64/x11-server-xephyr-1.2.0-8.1mdv2007.1.x86_64.rpm
 b7a993ad6689524f5328861f1415af4a  
2007.1/x86_64/x11-server-xfake-1.2.0-8.1mdv2007.1.x86_64.rpm
 bbcf31887871cb70d78b6c8c45bd236a  
2007.1/x86_64/x11-server-xfbdev-1.2.0-8.1mdv2007.1.x86_64.rpm
 03627273fc38f69659e62dff615e8dee  
2007.1/x86_64/x11-server-xgl-0.0.1-0.20070105.4.1mdv2007.1.x86_64.rpm
 f393ec9760d243e1171a7ad38d0ed70d  
2007.1/x86_64/x11-server-xnest-1.2.0-8.1mdv2007.1.x86_64.rpm
 95aeec7bb4cf44b44ae9c7ae8f020c6f  
2007.1/x86_64/x11-server-xorg-1.2.0-8.1mdv2007.1.x86_64.rpm
 00e692ed014b06e59922e12d8de52e16  
2007.1/x86_64/x11-server-xprt-1.2.0-8.1mdv2007.1.x86_64.rpm
 c0d22ee28f8e7fd394cf6e9cdcd7a876  
2007.1/x86_64/x11-server-xsdl-1.2.0-8.1mdv2007.1.x86_64.rpm
 d6f33606ca00eb807db566dab93830f5  
2007.1/x86_64/x11-server-xvfb-1.2.0-8.1mdv2007.1.x86_64.rpm
 e35758ceb44dddd8e368d0535ad03c49  
2007.1/x86_64/x11-server-xvnc-1.2.0-8.1mdv2007.1.x86_64.rpm 
 aeba38426c094f892a8db7c56ed8c301  
2007.1/SRPMS/libx11-1.1.1-2.1mdv2007.1.src.rpm
 0e7061bca9907c2b0eca9dacdab4403c  
2007.1/SRPMS/libxfont-1.2.7-1.1mdv2007.1.src.rpm
 4f8be7e1843b036a3368f13d4d6a964b  
2007.1/SRPMS/x11-server-1.2.0-8.1mdv2007.1.src.rpm
 3771f05b9e14a04e41905e6d145d0c41  
2007.1/SRPMS/x11-server-xgl-0.0.1-0.20070105.4.1mdv2007.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGHQammqjQ0CJFipgRAqaQAKCdjtSCGHIqRkCEZDq51Ybn/Tn6gwCg9H8G
JjBWGCkfa5AOJa5EdSZ4h0Y=
=Xwtx
-----END PGP SIGNATURE-----
Prev by Date: Steganos Encrypted Safe NOT so safe
Next by Date: [ MDKSA-2007:083 ] - Updated apache-mod_perl packages fix DoS vulnerability
Previous by thread: Re: Steganos Encrypted Safe NOT so safe
Next by thread: [ MDKSA-2007:083 ] - Updated apache-mod_perl packages fix DoS vulnerability
Index(es):
- Date
- Thread