File _patchinfo of Package patchinfo.3538

<patchinfo incident="3538">
  <packager>sndirsch</packager>
  <issue tracker="bnc" id="1002991">VUL-0: CVE-2016-7942, CVE-2016-7943: xorg-x11-libX11,libX11: insufficient validation of data from the X server</issue>
  <issue tracker="bnc" id="1002998">VUL-0: CVE-2016-7945, CVE-2016-7946: libXi: Integer overflows causes mishandling of reply data from the X server</issue>
  <issue tracker="bnc" id="1003000">VUL-0: CVE-2016-7947, CVE-2016-7948: libXrandr: insufficient validation of data  can cause out of boundary memory writes.</issue>
  <issue tracker="bnc" id="1003023">VUL-0: CVE-2016-7953: libXvMC:  Single byte buffer read underrun in XvMCGetDRInfo</issue>
  <issue tracker="bnc" id="1003017">VUL-0: CVE-2016-5407: xorg-x11-libXv, libXv: Insufficient validation cause out of boundary memory and memory corruption issues</issue>
  <issue tracker="bnc" id="1003002">VUL-0: CVE-2016-7949, CVE-2016-7950: xorg-x11-libXrender, libXrender: Insufficient validation of data length can cause out of boundary memory writes.</issue>
  <issue tracker="bnc" id="1003012">VUL-0: CVE-2016-7951, CVE-2016-7952: libXtst: Out of boundary memory access or endless loop due to incorrect input validation</issue>
  <issue tracker="bnc" id="1002995">VUL-0: CVE-2016-7944: libXfixes, xorg-x11-libXfixes: Insufficient validation of data from the X server causing integer overflow on 32 bit arch</issue>
  <issue tracker="cve" id="2016-7949"></issue>
  <issue tracker="cve" id="2016-7948"></issue>
  <issue tracker="cve" id="2016-7942"></issue>
  <issue tracker="cve" id="2016-7952"></issue>
  <issue tracker="cve" id="2016-7953"></issue>
  <issue tracker="cve" id="2016-7950"></issue>
  <issue tracker="cve" id="2016-7951"></issue>
  <issue tracker="cve" id="2016-7945"></issue>
  <issue tracker="cve" id="2016-7944"></issue>
  <issue tracker="cve" id="2016-7947"></issue>
  <issue tracker="cve" id="2016-7946"></issue>
  <issue tracker="cve" id="2016-5407"></issue>
  <category>security</category>
  <rating>moderate</rating>
  <summary>Security update for X Window System client libraries</summary>
  <description>
This update for the X Window System client libraries fixes a class of privilege escalation issues.

A malicious X Server could send specially crafted data to X clients, which allowed for triggering
crashes, or privilege escalation if this relationship was untrusted or crossed user or permission
level boundaries.

libX11, libXfixes, libXi, libXrandr, libXrender, libXtst, libXv, libXvMC were fixed, specifically:

libX11:
- CVE-2016-7942: insufficient validation of data from the X server allowed out of boundary memory
  read (bsc#1002991)

libXfixes:
- CVE-2016-7944: insufficient validation of data from the X server can cause an integer overflow
  on 32 bit architectures (bsc#1002995)

libXi:
- CVE-2016-7945, CVE-2016-7946: insufficient validation of data from the X server can cause out of
  boundary memory access or endless loops (Denial of Service) (bsc#1002998)

libXtst:
- CVE-2016-7951, CVE-2016-7952: insufficient validation of data from the X server can cause out of
  boundary memory access or endless loops (Denial of Service) (bsc#1003012)

libXv:
- CVE-2016-5407: insufficient validation of data from the X server can cause out of boundary memory
  and memory corruption (bsc#1003017)

libXvMC:
- CVE-2016-7953: insufficient validation of data from the X server can cause a one byte buffer read
  underrun (bsc#1003023)

libXrender:
- CVE-2016-7949, CVE-2016-7950: insufficient validation of data from the X server can cause out of
  boundary memory writes (bsc#1003002)

libXrandr:
- CVE-2016-7947, CVE-2016-7948: insufficient validation of data from the X server can cause out of
  boundary memory writes (bsc#1003000)
</description>
  <relogin_needed/>
</patchinfo>