Security update for xorg-x11-libXv
SUSE Security Update: Security update for xorg-x11-libXv
This is a SUSE Linux Enterprise Server 11 SP1 LTSS roll up update of
xorg-x11-libXv, fixing security issues and some bugs.
These issues require connection to a malicious X server to trigger the
bugs in client libraries.
Security issues fixed:
* CVE-2013-1989: Multiple integer overflows in X.org libXv allowed X
servers to trigger allocation of insufficient memory and a buffer
overflow via vectors related to the (1) XvQueryPortAttributes, (2)
XvListImageFormats, and (3) XvCreateImage function.
* CVE-2013-2066: Buffer overflow in X.org libXv allowed X servers to
cause a denial of service (crash) and possibly execute arbitrary
code via crafted length or index values to the XvQueryPortAttributes
function.
Security Issues references:
* CVE-2013-1989
* CVE-2013-2066
| Announcement ID: | SUSE-SU-2014:0882-1 |
| Rating: | moderate |
| References: | #815451 #821671 |
| Affected Products: |
An update that fixes two vulnerabilities is now available.
Description:
This is a SUSE Linux Enterprise Server 11 SP1 LTSS roll up update of
xorg-x11-libXv, fixing security issues and some bugs.
These issues require connection to a malicious X server to trigger the
bugs in client libraries.
Security issues fixed:
* CVE-2013-1989: Multiple integer overflows in X.org libXv allowed X
servers to trigger allocation of insufficient memory and a buffer
overflow via vectors related to the (1) XvQueryPortAttributes, (2)
XvListImageFormats, and (3) XvCreateImage function.
* CVE-2013-2066: Buffer overflow in X.org libXv allowed X servers to
cause a denial of service (crash) and possibly execute arbitrary
code via crafted length or index values to the XvQueryPortAttributes
function.
Security Issues references:
* CVE-2013-1989
* CVE-2013-2066
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11 SP1 LTSS:
zypper in -t patch slessp1-xorg-x11-libXv-9389
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64):
- xorg-x11-libXv-7.4-1.16.8
- SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64):
- xorg-x11-libXv-32bit-7.4-1.16.8
References:
- http://support.novell.com/security/cve/CVE-2013-1989.html
- http://support.novell.com/security/cve/CVE-2013-2066.html
- https://bugzilla.novell.com/815451
- https://bugzilla.novell.com/821671
- http://download.suse.com/patch/finder/?keywords=501d7c5d73f60606c43e24edd27df5f0