[ MDVSA-2008:025 ] - Updated x11-server-xgl packages fix multiple vulnerabilities
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2008:025
http://www.mandriva.com/security/
_______________________________________________________________________
Package : x11-server-xgl
Date : January 23, 2008
Affected: 2007.0, 2007.1, 2008.0
_______________________________________________________________________
Problem Description:
An input validation flaw was found in the X.org server's XFree86-Misc
extension that could allow a malicious authorized client to cause
a denial of service (crash), or potentially execute arbitrary code
with root privileges on the X.org server (CVE-2007-5760).
A flaw was found in the X.org server's XC-SECURITY extension that
could allow a local user to verify the existence of an arbitrary file,
even in directories that are not normally accessible to that user
(CVE-2007-5958).
A memory corruption flaw was found in the X.org server's XInput
extension that could allow a malicious authorized client to cause a
denial of service (crash) or potentially execute arbitrary code with
root privileges on the X.org server (CVE-2007-6427).
An information disclosure flaw was found in the X.org server's TOG-CUP
extension that could allow a malicious authorized client to cause
a denial of service (crash) or potentially view arbitrary memory
content within the X.org server's address space (CVE-2007-6428).
Two integer overflow flaws were found in the X.org server's EVI and
MIT-SHM modules that could allow a malicious authorized client to
cause a denial of service (crash) or potentially execute arbitrary
code with the privileges of the X.org server (CVE-2007-6429).
The updated packages have been patched to correct these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5760
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5958
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
dd641b0925b43a3c6db839717424f150
2007.0/i586/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.i586.rpm
3747f570ab5133bc33992aa6eb88119b
2007.0/SRPMS/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
8d451268a57d8994f0ce0cf04f830ccf
2007.0/x86_64/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.x86_64.rpm
3747f570ab5133bc33992aa6eb88119b
2007.0/SRPMS/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.src.rpm
Mandriva Linux 2007.1:
5984120f81b569ed1d5ce33a4b99811c
2007.1/i586/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.i586.rpm
d5ea53e985f860f4283a31871e92cb24
2007.1/SRPMS/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
844815151b636f617544c15327d79c23
2007.1/x86_64/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.x86_64.rpm
d5ea53e985f860f4283a31871e92cb24
2007.1/SRPMS/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.src.rpm
Mandriva Linux 2008.0:
ee6ed1d6886652fc18672979d22a32d7
2008.0/i586/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.i586.rpm
9eb1f98a29c53dcd3226b5ac5a8e28c7
2008.0/SRPMS/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
67d964ead0d0f93df039c4d06ebf1b8c
2008.0/x86_64/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.x86_64.rpm
9eb1f98a29c53dcd3226b5ac5a8e28c7
2008.0/SRPMS/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)
iD8DBQFHmAl6mqjQ0CJFipgRAngpAJ46CwvieuNFdn+cdGTfjxFOLgVW2gCghV9B
BcCpDxAjOd8uqLpJaujN7BI=
=PkXK
-----END PGP SIGNATURE-----