what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Mandriva Linux Security Advisory 2013-260

Mandriva Linux Security Advisory 2013-260
Posted Oct 28, 2013
Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2013-260 - Multiple vulnerabilities have been discovered and corrected in x11-server. The updated packages have been patched to correct these issues.

tags | advisory, vulnerability
systems | linux, mandriva
advisories | CVE-2010-1166, CVE-2011-4028, CVE-2013-1940, CVE-2013-4396
SHA-256 | 50969d2a09bdf2e48ce14b12843f678f7e90396dd3d3c735132e96cfb2be5013

Mandriva Linux Security Advisory 2013-260

Change Mirror Download
Hash: SHA1


Mandriva Linux Security Advisory MDVSA-2013:260

Package : x11-server
Date : October 28, 2013
Affected: Enterprise Server 5.0

Problem Description:

Multiple vulnerabilities has been discovered and corrected in

The fbComposite function in fbpict.c in the Render extension in the
X server in X.Org X11R7.1 allows remote authenticated users to cause
a denial of service (memory corruption and daemon crash) or possibly
execute arbitrary code via a crafted request, related to an incorrect
macro definition (CVE-2010-1166).

The LockServer function in os/utils.c in X.Org xserver before 1.11.2
allows local users to determine the existence of arbitrary files via a
symlink attack on a temporary lock file, which is handled differently
if the file exists (CVE-2011-4028).

The LockServer function in os/utils.c in X.Org xserver before 1.11.2
allows local users to change the permissions of arbitrary files to
444, read those files, and possibly cause a denial of service (removed
execution permission) via a symlink attack on a temporary lock file

X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not
properly restrict access to input events when adding a new hot-plug
device, which might allow physically proximate attackers to obtain
sensitive information, as demonstrated by reading passwords from a tty

Use-after-free vulnerability in the doImageText function in
dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11
allows remote authenticated users to cause a denial of service (daemon
crash) or possibly execute arbitrary code via a crafted ImageText
request that triggers memory-allocation failure (CVE-2013-4396).

The updated packages have been patched to correct these issues.



Updated Packages:

Mandriva Enterprise Server 5:
a73aa283cf94400e0af0b11fc8a2a6b9 mes5/i586/x11-server-1.4.2-11.3mdvmes5.2.i586.rpm
a65c8e58bd15175c8352da38a5721c43 mes5/i586/x11-server-common-1.4.2-11.3mdvmes5.2.i586.rpm
d4398c247ed04a13a2d3f5c051dcee88 mes5/i586/x11-server-devel-1.4.2-11.3mdvmes5.2.i586.rpm
29078fbf5bf33fef699c321d9c97ccc6 mes5/i586/x11-server-xdmx-1.4.2-11.3mdvmes5.2.i586.rpm
a9d443ea9de2368373af2c347469fe42 mes5/i586/x11-server-xephyr-1.4.2-11.3mdvmes5.2.i586.rpm
3b9f1956088c7e12a175765161144690 mes5/i586/x11-server-xfake-1.4.2-11.3mdvmes5.2.i586.rpm
8135ba65d0b038423d27b4815c1b390b mes5/i586/x11-server-xfbdev-1.4.2-11.3mdvmes5.2.i586.rpm
c2f4b333fe7c6f9a2b30d6cc30984e0d mes5/i586/x11-server-xnest-1.4.2-11.3mdvmes5.2.i586.rpm
c76331eb74f237b911cb21787336f49b mes5/i586/x11-server-xorg-1.4.2-11.3mdvmes5.2.i586.rpm
f37f1f00901b0b59e95c71c86861a384 mes5/i586/x11-server-xsdl-1.4.2-11.3mdvmes5.2.i586.rpm
727295af93352d079a60b3c1f92b5018 mes5/i586/x11-server-xvfb-1.4.2-11.3mdvmes5.2.i586.rpm
ca3bd6b9d68e2116a5760e4ea8b9ff0c mes5/i586/x11-server-xvnc-1.4.2-11.3mdvmes5.2.i586.rpm
c406dd6e75c04cbf78bbc0afe0618cdf mes5/SRPMS/x11-server-1.4.2-11.3mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
00dff9eca0385261fcbb82cea561f2bc mes5/x86_64/x11-server-1.4.2-11.3mdvmes5.2.x86_64.rpm
3855173ec01c95f2ebfd97dfc768e166 mes5/x86_64/x11-server-common-1.4.2-11.3mdvmes5.2.x86_64.rpm
a85befa24073def2a6df5e28c97ca58c mes5/x86_64/x11-server-devel-1.4.2-11.3mdvmes5.2.x86_64.rpm
17d1a36a63bd48fe003414b28f075572 mes5/x86_64/x11-server-xdmx-1.4.2-11.3mdvmes5.2.x86_64.rpm
55826f5ea8d83e30e09338d5d11634a6 mes5/x86_64/x11-server-xephyr-1.4.2-11.3mdvmes5.2.x86_64.rpm
4a6bd309659efa2cf5050747ac06728e mes5/x86_64/x11-server-xfake-1.4.2-11.3mdvmes5.2.x86_64.rpm
ead9ec3aca0b3920df94d5046444e5b8 mes5/x86_64/x11-server-xfbdev-1.4.2-11.3mdvmes5.2.x86_64.rpm
8601ccbbe5ec8118a467049e2d126001 mes5/x86_64/x11-server-xnest-1.4.2-11.3mdvmes5.2.x86_64.rpm
63054297d0b0c31fe6c5af9725cfced3 mes5/x86_64/x11-server-xorg-1.4.2-11.3mdvmes5.2.x86_64.rpm
f17aff8621da91cb9c8794400f44f8c0 mes5/x86_64/x11-server-xsdl-1.4.2-11.3mdvmes5.2.x86_64.rpm
eed4bc40b9a9cfa7b44ddc1d1c0f377f mes5/x86_64/x11-server-xvfb-1.4.2-11.3mdvmes5.2.x86_64.rpm
4bdd1d1dd6f8b4088f70257f599f5311 mes5/x86_64/x11-server-xvnc-1.4.2-11.3mdvmes5.2.x86_64.rpm
c406dd6e75c04cbf78bbc0afe0618cdf mes5/SRPMS/x11-server-1.4.2-11.3mdvmes5.2.src.rpm

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:


If you want to report vulnerabilities, please contact


Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
Version: GnuPG v1.4.12 (GNU/Linux)


Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By