This update for libX11 fixes the following security issues:
- CVE-2018-14599: The function XListExtensions was vulnerable to an off-by-one
error caused by malicious server responses, leading to DoS or possibly
unspecified other impact (bsc#1102062)
- CVE-2018-14600: The function XListExtensions interpreted a variable as signed
instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes),
leading to DoS or remote code execution (bsc#1102068)
- CVE-2018-14598: A malicious server could have sent a reply in which the first
string overflows, causing a variable to be set to NULL that will be freed later
on, leading to DoS (segmentation fault) (bsc#1102073)
This update was imported from the SUSE:SLE-15:Update update project.
-
Submitted by
Stefan Dirsch (sndirsch)