-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDKSA-2007:079-1 http://www.mandriva.com/security/ _______________________________________________________________________ Package : xorg-x11 Date : April 11, 2007 Affected: 2007.1 _______________________________________________________________________ Problem Description: Local exploitation of a memory corruption vulnerability in the X.Org and XFree86 X server could allow an attacker to execute arbitrary code with privileges of the X server, typically root. The vulnerability exists in the ProcXCMiscGetXIDList() function in the XC-MISC extension. This request is used to determine what resource IDs are available for use. This function contains two vulnerabilities, both result in memory corruption of either the stack or heap. The ALLOCATE_LOCAL() macro used by this function allocates memory on the stack using alloca() on systems where alloca() is present, or using the heap otherwise. The handler function takes a user provided value, multiplies it, and then passes it to the above macro. This results in both an integer overflow vulnerability, and an alloca() stack pointer shifting vulnerability. Both can be exploited to execute arbitrary code. (CVE-2007-1003) iDefense reported two integer overflows in the way X.org handled various font files. A malicious local user could exploit these issues to potentially execute arbitrary code with the privileges of the X.org server. (CVE-2007-1351, CVE-2007-1352) Multiple integer overflows in (1) the XGetPixel function in ImUtil.c in x.org libx11 before 1.0.3, and (2) XInitImage function in xwd.c for ImageMagick, allow user-assisted remote attackers to cause a denial of service (crash) or information leak via crafted images with large or negative values that trigger a buffer overflow. (CVE-2007-1667) Updated packages are patched to address these issues. Update: Packages for Mandriva Linux 2007.1 are now available. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1003 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1351 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1667 _______________________________________________________________________ Updated Packages: Mandriva Linux 2007.1: 094834b9cec06d41814fcfbb4826a1b4 2007.1/i586/libx11-common-1.1.1-2.1mdv2007.1.i586.rpm 60ba6ee2def612bab83b056aa9143c28 2007.1/i586/libx11_6-1.1.1-2.1mdv2007.1.i586.rpm 83832a8b9a359f0199bf0b58024bcc93 2007.1/i586/libx11_6-devel-1.1.1-2.1mdv2007.1.i586.rpm e7f0426150c15b701dca49a131d4f911 2007.1/i586/libx11_6-static-devel-1.1.1-2.1mdv2007.1.i586.rpm 4d737b55208b15a17076ea417fef6e83 2007.1/i586/libxfont1-1.2.7-1.1mdv2007.1.i586.rpm 28b347acb8851ef8cdc9b8b61ffb669b 2007.1/i586/libxfont1-devel-1.2.7-1.1mdv2007.1.i586.rpm aa2e50b1ee6967c2ed3bb8c6dc64c84b 2007.1/i586/libxfont1-static-devel-1.2.7-1.1mdv2007.1.i586.rpm 530b51e76f6b9a0df342719a8b9ddb99 2007.1/i586/x11-server-1.2.0-8.1mdv2007.1.i586.rpm 9d717cb5fab234a4c76a4a0811bf4638 2007.1/i586/x11-server-common-1.2.0-8.1mdv2007.1.i586.rpm 5a47c5a19827c3e820b02c2db7796659 2007.1/i586/x11-server-devel-1.2.0-8.1mdv2007.1.i586.rpm 76a33d69862b1c457a2cec21a37b51d8 2007.1/i586/x11-server-xati-1.2.0-8.1mdv2007.1.i586.rpm 880f19417b5379635ddb6c5f2e612971 2007.1/i586/x11-server-xchips-1.2.0-8.1mdv2007.1.i586.rpm dc8db2e2fa639a5e5590a9301590e58a 2007.1/i586/x11-server-xdmx-1.2.0-8.1mdv2007.1.i586.rpm b71ce20ae5de448b2e54d6458df98526 2007.1/i586/x11-server-xephyr-1.2.0-8.1mdv2007.1.i586.rpm fed1ade3cb4ca74c6362837618a5452c 2007.1/i586/x11-server-xepson-1.2.0-8.1mdv2007.1.i586.rpm 9e3f8d012b49126ee4b217dd24521f29 2007.1/i586/x11-server-xfake-1.2.0-8.1mdv2007.1.i586.rpm 15adb208aac159c1575a3ddd77ffbaee 2007.1/i586/x11-server-xfbdev-1.2.0-8.1mdv2007.1.i586.rpm 37b8f6fdbfca1dc9192758dabd9b5adc 2007.1/i586/x11-server-xgl-0.0.1-0.20070105.4.1mdv2007.1.i586.rpm f8a04c4056025562b4e280a09c5c8577 2007.1/i586/x11-server-xi810-1.2.0-8.1mdv2007.1.i586.rpm ce53fc038ab1f432b216d4057e53057d 2007.1/i586/x11-server-xmach64-1.2.0-8.1mdv2007.1.i586.rpm a6fe363ba43b509661709a3c9245ba8c 2007.1/i586/x11-server-xmga-1.2.0-8.1mdv2007.1.i586.rpm d95d4a1b0b7e9bdee00f7cf90e934a39 2007.1/i586/x11-server-xneomagic-1.2.0-8.1mdv2007.1.i586.rpm 7718f0eabcc0b212012ffb0e5c8e6a26 2007.1/i586/x11-server-xnest-1.2.0-8.1mdv2007.1.i586.rpm 5c06fbc05c7ea8abfdb4ecdeb2ce2d75 2007.1/i586/x11-server-xnvidia-1.2.0-8.1mdv2007.1.i586.rpm aa416e9d9cc207be2c801c4570d43015 2007.1/i586/x11-server-xorg-1.2.0-8.1mdv2007.1.i586.rpm 9076d8da47cfa869a84896cd26722ecc 2007.1/i586/x11-server-xpm2-1.2.0-8.1mdv2007.1.i586.rpm b6c9e9c76bfb9ad237fff6b4c2ce2e04 2007.1/i586/x11-server-xprt-1.2.0-8.1mdv2007.1.i586.rpm dcaf5905ffdd594ac3b97aa1b94baae6 2007.1/i586/x11-server-xr128-1.2.0-8.1mdv2007.1.i586.rpm 770630c3643c095ba99d8fbd838bf148 2007.1/i586/x11-server-xsdl-1.2.0-8.1mdv2007.1.i586.rpm 57c93b2b5f8e289063dc5bd678a15e17 2007.1/i586/x11-server-xsmi-1.2.0-8.1mdv2007.1.i586.rpm 8e26db22cbba03a68962ecaa7f0f40d0 2007.1/i586/x11-server-xvesa-1.2.0-8.1mdv2007.1.i586.rpm caa3a31e61065af8dd25b8f115657910 2007.1/i586/x11-server-xvfb-1.2.0-8.1mdv2007.1.i586.rpm f5baee2c239e4b9d5f5c1e0d0ae64ddd 2007.1/i586/x11-server-xvia-1.2.0-8.1mdv2007.1.i586.rpm 1be993d23f79ba6356b7dfcb0dd36b44 2007.1/i586/x11-server-xvnc-1.2.0-8.1mdv2007.1.i586.rpm aeba38426c094f892a8db7c56ed8c301 2007.1/SRPMS/libx11-1.1.1-2.1mdv2007.1.src.rpm 0e7061bca9907c2b0eca9dacdab4403c 2007.1/SRPMS/libxfont-1.2.7-1.1mdv2007.1.src.rpm 4f8be7e1843b036a3368f13d4d6a964b 2007.1/SRPMS/x11-server-1.2.0-8.1mdv2007.1.src.rpm 3771f05b9e14a04e41905e6d145d0c41 2007.1/SRPMS/x11-server-xgl-0.0.1-0.20070105.4.1mdv2007.1.src.rpm Mandriva Linux 2007.1/X86_64: a8e9b831949d99880f61e496fcda81fa 2007.1/x86_64/lib64x11_6-1.1.1-2.1mdv2007.1.x86_64.rpm 8a2cdcf52cb086a7ec479585f4615aff 2007.1/x86_64/lib64x11_6-devel-1.1.1-2.1mdv2007.1.x86_64.rpm 9a3f679f360cf576598f3bd2058b441c 2007.1/x86_64/lib64x11_6-static-devel-1.1.1-2.1mdv2007.1.x86_64.rpm 38588291d4baf93d53f2cacfc91470fc 2007.1/x86_64/lib64xfont1-1.2.7-1.1mdv2007.1.x86_64.rpm 08a34ff0e3a6a6c25beaef8b5f4d6dbf 2007.1/x86_64/lib64xfont1-devel-1.2.7-1.1mdv2007.1.x86_64.rpm 0709d442ee2fdc7134abb5d1a71afab1 2007.1/x86_64/lib64xfont1-static-devel-1.2.7-1.1mdv2007.1.x86_64.rpm ee41dd9b5381466727456905d4c2b29a 2007.1/x86_64/libx11-common-1.1.1-2.1mdv2007.1.x86_64.rpm 99fdfc64834e47ed1efc35796f1da887 2007.1/x86_64/x11-server-1.2.0-8.1mdv2007.1.x86_64.rpm 47570e6070fc356fe3213d5787990a1c 2007.1/x86_64/x11-server-common-1.2.0-8.1mdv2007.1.x86_64.rpm deb1c9a780b5789f71c7b3bc23c24f2c 2007.1/x86_64/x11-server-devel-1.2.0-8.1mdv2007.1.x86_64.rpm 21d5e1148cc503e47a135fad2cf10257 2007.1/x86_64/x11-server-xdmx-1.2.0-8.1mdv2007.1.x86_64.rpm 500a8bb735d0cdda28044f85d436ea64 2007.1/x86_64/x11-server-xephyr-1.2.0-8.1mdv2007.1.x86_64.rpm b7a993ad6689524f5328861f1415af4a 2007.1/x86_64/x11-server-xfake-1.2.0-8.1mdv2007.1.x86_64.rpm bbcf31887871cb70d78b6c8c45bd236a 2007.1/x86_64/x11-server-xfbdev-1.2.0-8.1mdv2007.1.x86_64.rpm 03627273fc38f69659e62dff615e8dee 2007.1/x86_64/x11-server-xgl-0.0.1-0.20070105.4.1mdv2007.1.x86_64.rpm f393ec9760d243e1171a7ad38d0ed70d 2007.1/x86_64/x11-server-xnest-1.2.0-8.1mdv2007.1.x86_64.rpm 95aeec7bb4cf44b44ae9c7ae8f020c6f 2007.1/x86_64/x11-server-xorg-1.2.0-8.1mdv2007.1.x86_64.rpm 00e692ed014b06e59922e12d8de52e16 2007.1/x86_64/x11-server-xprt-1.2.0-8.1mdv2007.1.x86_64.rpm c0d22ee28f8e7fd394cf6e9cdcd7a876 2007.1/x86_64/x11-server-xsdl-1.2.0-8.1mdv2007.1.x86_64.rpm d6f33606ca00eb807db566dab93830f5 2007.1/x86_64/x11-server-xvfb-1.2.0-8.1mdv2007.1.x86_64.rpm e35758ceb44dddd8e368d0535ad03c49 2007.1/x86_64/x11-server-xvnc-1.2.0-8.1mdv2007.1.x86_64.rpm aeba38426c094f892a8db7c56ed8c301 2007.1/SRPMS/libx11-1.1.1-2.1mdv2007.1.src.rpm 0e7061bca9907c2b0eca9dacdab4403c 2007.1/SRPMS/libxfont-1.2.7-1.1mdv2007.1.src.rpm 4f8be7e1843b036a3368f13d4d6a964b 2007.1/SRPMS/x11-server-1.2.0-8.1mdv2007.1.src.rpm 3771f05b9e14a04e41905e6d145d0c41 2007.1/SRPMS/x11-server-xgl-0.0.1-0.20070105.4.1mdv2007.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQFGHQammqjQ0CJFipgRAqaQAKCdjtSCGHIqRkCEZDq51Ybn/Tn6gwCg9H8G JjBWGCkfa5AOJa5EdSZ4h0Y= =Xwtx -----END PGP SIGNATURE-----
