Security update for xorg-x11-libX11
SUSE Security Update: Security update for xorg-x11-libX11
This is a SUSE Linux Enterprise Server 11 SP1 LTSS roll up update of
xorg-x11-libX11, fixing a security issues.
These issues require connection to a malicious X server to trigger the
bugs in client libraries.
Security issues fixed:
*
CVE-2013-1981: Multiple integer overflows in X.org libX11 allowed X
servers to trigger allocation of insufficient memory and a buffer
overflow via vectors related to the (1) XQueryFont, (2)
_XF86BigfontQueryFont, (3) XListFontsWithInfo, (4) XGetMotionEvents, (5)
XListHosts, (6) XGetModifierMapping, (7) XGetPointerMapping, (8)
XGetKeyboardMapping, (9) XGetWindowProperty, (10) XGetImage, (11)
LoadColornameDB, (12) XrmGetFileDatabase, (13) _XimParseStringFile,
or (14) TransFileName functions.
*
CVE-2013-1997: Multiple buffer overflows in X.org libX11 allowed X
servers to cause a denial of service (crash) and possibly execute
arbitrary code via crafted length or index values to the (1)
XAllocColorCells, (2) _XkbReadGetDeviceInfoReply, (3) _XkbReadGeomShapes,
(4) _XkbReadGetGeometryReply, (5) _XkbReadKeySyms, (6) _XkbReadKeyActions,
(7) _XkbReadKeyBehaviors, (8) _XkbReadModifierMap, (9)
_XkbReadExplicitComponents, (10) _XkbReadVirtualModMap, (11)
_XkbReadGetNamesReply, (12) _XkbReadGetMapReply, (13) _XimXGetReadData,
(14) XListFonts, (15) XListExtensions, and (16) XGetFontPath functions.
*
CVE-2013-2004: The (1) GetDatabase and (2) _XimParseStringFile
functions in X.org libX11 did not restrict the recursion depth when
processing directives to include files, which allowed X servers to cause a
denial of service (stack consumption) via a crafted file.
Security Issue references:
* CVE-2013-1981
* CVE-2013-1997
* CVE-2013-2004
| Announcement ID: | SUSE-SU-2014:0893-1 |
| Rating: | moderate |
| References: | #815451 #821664 #824294 |
| Affected Products: |
An update that fixes three vulnerabilities is now available.
Description:
This is a SUSE Linux Enterprise Server 11 SP1 LTSS roll up update of
xorg-x11-libX11, fixing a security issues.
These issues require connection to a malicious X server to trigger the
bugs in client libraries.
Security issues fixed:
*
CVE-2013-1981: Multiple integer overflows in X.org libX11 allowed X
servers to trigger allocation of insufficient memory and a buffer
overflow via vectors related to the (1) XQueryFont, (2)
_XF86BigfontQueryFont, (3) XListFontsWithInfo, (4) XGetMotionEvents, (5)
XListHosts, (6) XGetModifierMapping, (7) XGetPointerMapping, (8)
XGetKeyboardMapping, (9) XGetWindowProperty, (10) XGetImage, (11)
LoadColornameDB, (12) XrmGetFileDatabase, (13) _XimParseStringFile,
or (14) TransFileName functions.
*
CVE-2013-1997: Multiple buffer overflows in X.org libX11 allowed X
servers to cause a denial of service (crash) and possibly execute
arbitrary code via crafted length or index values to the (1)
XAllocColorCells, (2) _XkbReadGetDeviceInfoReply, (3) _XkbReadGeomShapes,
(4) _XkbReadGetGeometryReply, (5) _XkbReadKeySyms, (6) _XkbReadKeyActions,
(7) _XkbReadKeyBehaviors, (8) _XkbReadModifierMap, (9)
_XkbReadExplicitComponents, (10) _XkbReadVirtualModMap, (11)
_XkbReadGetNamesReply, (12) _XkbReadGetMapReply, (13) _XimXGetReadData,
(14) XListFonts, (15) XListExtensions, and (16) XGetFontPath functions.
*
CVE-2013-2004: The (1) GetDatabase and (2) _XimParseStringFile
functions in X.org libX11 did not restrict the recursion depth when
processing directives to include files, which allowed X servers to cause a
denial of service (stack consumption) via a crafted file.
Security Issue references:
* CVE-2013-1981
* CVE-2013-1997
* CVE-2013-2004
Patch Instructions:
To install this SUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Server 11 SP1 LTSS:
zypper in -t patch slessp1-xorg-x11-libX11-9384
To bring your system up-to-date, use "zypper patch".
Package List:
- SUSE Linux Enterprise Server 11 SP1 LTSS (i586 s390x x86_64):
- xorg-x11-libX11-7.4-5.11.11.7
- SUSE Linux Enterprise Server 11 SP1 LTSS (s390x x86_64):
- xorg-x11-libX11-32bit-7.4-5.11.11.7
References:
- http://support.novell.com/security/cve/CVE-2013-1981.html
- http://support.novell.com/security/cve/CVE-2013-1997.html
- http://support.novell.com/security/cve/CVE-2013-2004.html
- https://bugzilla.novell.com/815451
- https://bugzilla.novell.com/821664
- https://bugzilla.novell.com/824294
- http://download.suse.com/patch/finder/?keywords=d1609b5cf39d255fcbe312ef9591f918