exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2013-260

Mandriva Linux Security Advisory 2013-260
Posted Oct 28, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-260 - Multiple vulnerabilities have been discovered and corrected in x11-server. The updated packages have been patched to correct these issues.

tags | advisory, vulnerability
systems | linux, mandriva
advisories | CVE-2010-1166, CVE-2011-4028, CVE-2013-1940, CVE-2013-4396
SHA-256 | 50969d2a09bdf2e48ce14b12843f678f7e90396dd3d3c735132e96cfb2be5013

Mandriva Linux Security Advisory 2013-260

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:260
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : x11-server
Date : October 28, 2013
Affected: Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple vulnerabilities has been discovered and corrected in
x11-server:

The fbComposite function in fbpict.c in the Render extension in the
X server in X.Org X11R7.1 allows remote authenticated users to cause
a denial of service (memory corruption and daemon crash) or possibly
execute arbitrary code via a crafted request, related to an incorrect
macro definition (CVE-2010-1166).

The LockServer function in os/utils.c in X.Org xserver before 1.11.2
allows local users to determine the existence of arbitrary files via a
symlink attack on a temporary lock file, which is handled differently
if the file exists (CVE-2011-4028).

The LockServer function in os/utils.c in X.Org xserver before 1.11.2
allows local users to change the permissions of arbitrary files to
444, read those files, and possibly cause a denial of service (removed
execution permission) via a symlink attack on a temporary lock file
(CVE-2011-4029).

X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not
properly restrict access to input events when adding a new hot-plug
device, which might allow physically proximate attackers to obtain
sensitive information, as demonstrated by reading passwords from a tty
(CVE-2013-1940).

Use-after-free vulnerability in the doImageText function in
dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11
allows remote authenticated users to cause a denial of service (daemon
crash) or possibly execute arbitrary code via a crafted ImageText
request that triggers memory-allocation failure (CVE-2013-4396).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1166
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4028
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1940
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4396
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
a73aa283cf94400e0af0b11fc8a2a6b9 mes5/i586/x11-server-1.4.2-11.3mdvmes5.2.i586.rpm
a65c8e58bd15175c8352da38a5721c43 mes5/i586/x11-server-common-1.4.2-11.3mdvmes5.2.i586.rpm
d4398c247ed04a13a2d3f5c051dcee88 mes5/i586/x11-server-devel-1.4.2-11.3mdvmes5.2.i586.rpm
29078fbf5bf33fef699c321d9c97ccc6 mes5/i586/x11-server-xdmx-1.4.2-11.3mdvmes5.2.i586.rpm
a9d443ea9de2368373af2c347469fe42 mes5/i586/x11-server-xephyr-1.4.2-11.3mdvmes5.2.i586.rpm
3b9f1956088c7e12a175765161144690 mes5/i586/x11-server-xfake-1.4.2-11.3mdvmes5.2.i586.rpm
8135ba65d0b038423d27b4815c1b390b mes5/i586/x11-server-xfbdev-1.4.2-11.3mdvmes5.2.i586.rpm
c2f4b333fe7c6f9a2b30d6cc30984e0d mes5/i586/x11-server-xnest-1.4.2-11.3mdvmes5.2.i586.rpm
c76331eb74f237b911cb21787336f49b mes5/i586/x11-server-xorg-1.4.2-11.3mdvmes5.2.i586.rpm
f37f1f00901b0b59e95c71c86861a384 mes5/i586/x11-server-xsdl-1.4.2-11.3mdvmes5.2.i586.rpm
727295af93352d079a60b3c1f92b5018 mes5/i586/x11-server-xvfb-1.4.2-11.3mdvmes5.2.i586.rpm
ca3bd6b9d68e2116a5760e4ea8b9ff0c mes5/i586/x11-server-xvnc-1.4.2-11.3mdvmes5.2.i586.rpm
c406dd6e75c04cbf78bbc0afe0618cdf mes5/SRPMS/x11-server-1.4.2-11.3mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
00dff9eca0385261fcbb82cea561f2bc mes5/x86_64/x11-server-1.4.2-11.3mdvmes5.2.x86_64.rpm
3855173ec01c95f2ebfd97dfc768e166 mes5/x86_64/x11-server-common-1.4.2-11.3mdvmes5.2.x86_64.rpm
a85befa24073def2a6df5e28c97ca58c mes5/x86_64/x11-server-devel-1.4.2-11.3mdvmes5.2.x86_64.rpm
17d1a36a63bd48fe003414b28f075572 mes5/x86_64/x11-server-xdmx-1.4.2-11.3mdvmes5.2.x86_64.rpm
55826f5ea8d83e30e09338d5d11634a6 mes5/x86_64/x11-server-xephyr-1.4.2-11.3mdvmes5.2.x86_64.rpm
4a6bd309659efa2cf5050747ac06728e mes5/x86_64/x11-server-xfake-1.4.2-11.3mdvmes5.2.x86_64.rpm
ead9ec3aca0b3920df94d5046444e5b8 mes5/x86_64/x11-server-xfbdev-1.4.2-11.3mdvmes5.2.x86_64.rpm
8601ccbbe5ec8118a467049e2d126001 mes5/x86_64/x11-server-xnest-1.4.2-11.3mdvmes5.2.x86_64.rpm
63054297d0b0c31fe6c5af9725cfced3 mes5/x86_64/x11-server-xorg-1.4.2-11.3mdvmes5.2.x86_64.rpm
f17aff8621da91cb9c8794400f44f8c0 mes5/x86_64/x11-server-xsdl-1.4.2-11.3mdvmes5.2.x86_64.rpm
eed4bc40b9a9cfa7b44ddc1d1c0f377f mes5/x86_64/x11-server-xvfb-1.4.2-11.3mdvmes5.2.x86_64.rpm
4bdd1d1dd6f8b4088f70257f599f5311 mes5/x86_64/x11-server-xvnc-1.4.2-11.3mdvmes5.2.x86_64.rpm
c406dd6e75c04cbf78bbc0afe0618cdf mes5/SRPMS/x11-server-1.4.2-11.3mdvmes5.2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFSbpZAmqjQ0CJFipgRAnWmAJsEW+zmI6qQ1n7ymdVvWsZlvbEqFgCglfPj
C/9sa3mMpDy0Vwb9mdiE2XI=
=iLmr
-----END PGP SIGNATURE-----


Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close