openSUSE Build Service

Overview Details Repositories Revisions Requests Users Attributes Meta

File _patchinfo of Package patchinfo (Revision e2521e5f4a39e6eb9a8ec991fed89d3f)

Currently displaying revision e2521e5f4a39e6eb9a8ec991fed89d3f , Show latest

<patchinfo incident="5949">
  <issue id="1002995" tracker="bnc">VUL-0: CVE-2016-7944: libXfixes, xorg-x11-libXfixes: Insufficient validation of data from the X server causing integer overflow on 32 bit arch</issue>
  <issue id="1002991" tracker="bnc">VUL-0: CVE-2016-7942, CVE-2016-7943: xorg-x11-libX11,libX11: insufficient validation of data from the X server</issue>
  <issue id="1002998" tracker="bnc">VUL-0: CVE-2016-7945, CVE-2016-7946: libXi: Integer overflows causes mishandling of reply data from the X server</issue>
  <issue id="2016-7944" tracker="cve" />
  <issue id="2016-7942" tracker="cve" />
  <issue id="2016-7945" tracker="cve" />
  <issue id="2016-7946" tracker="cve" />
  <category>security</category>
  <rating>moderate</rating>
  <packager>sndirsch</packager>
  <description>
This update for for X Window System client libraries fixes a class of
privilege escalation issues.

A malicious X server could send specially crated data to X clients, which
allowed for triggering crashes, or privilege escalation if this relationship
was untrusted or crossed user or permission level boundaries.

The following libraries have been fixed:

libXfixes:

- insufficient validation of data from the X server can cause an integer
  overflow on 32 bit architectures (boo#1002995, CVE-2016-7944)

libX11:
 
- plugged a memory leak (boo#1002991, CVE-2016-7942)
- insufficient validation of data from the X server can cause
  out of boundary memory read (XGetImage()) or write (XListFonts())
  (boo#1002991, CVE-2016-7942)

libXi:

- Integer overflows in libXI can cause out of boundary memory access or
  endless loops (Denial of Service) (boo#1002998, CVE-2016-7945).
- Insufficient validation of data in libXI can cause out of boundary memory
  access or endless loops (Denial of Service) (boo#1002998, CVE-2016-7946).
</description>
<summary>Security update for X Window System client libraries</summary>
</patchinfo>

Places

File _patchinfo of Package patchinfo (Revision e2521e5f4a39e6eb9a8ec991fed89d3f)

Places