Bugtraq mailing list archives
[ GLSA 200710-11 ] X Font Server: Multiple Vulnerabilities
From: Pierre-Yves Rofes <py () gentoo org>
Date: Fri, 12 Oct 2007 23:30:47 +0200
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200710-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: X Font Server: Multiple Vulnerabilities Date: October 12, 2007 Bugs: #185660, #194606 ID: 200710-11 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Three vulnerabilities have been discovered in the X Font Server possibly allowing local attackers to gain elevated privileges. Background ========== The X.Org X11 X Font Server provides a standard mechanism for an X server to communicate with a font renderer. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 x11-apps/xfs < 1.0.5 >= 1.0.5 Description =========== iDefense reported that the xfs init script does not correctly handle a race condition when setting permissions of a temporary file (CVE-2007-3103). Sean Larsson discovered an integer overflow vulnerability in the build_range() function possibly leading to a heap-based buffer overflow when handling "QueryXBitmaps" and "QueryXExtents" protocol requests (CVE-2007-4568). Sean Larsson also discovered an error in the swap_char2b() function possibly leading to a heap corruption when handling the same protocol requests (CVE-2007-4990). Impact ====== The first issue would allow a local attacker to change permissions of arbitrary files to be world-writable by performing a symlink attack. The second and third issues would allow a local attacker to execute arbitrary code with privileges of the user running the X Font Server, usually xfs. Workaround ========== There is no known workaround at this time. Resolution ========== All X Font Server users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=x11-apps/xfs-1.0.5" References ========== [ 1 ] CVE-2007-3103 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3103 [ 2 ] CVE-2007-4568 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4568 [ 3 ] CVE-2007-4990 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4990 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200710-11.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security () gentoo org or alternatively, you may file a bug at http://bugs.gentoo.org. License ======= Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFHD+eHuhJ+ozIKI5gRAlcdAJ4t+dNJKPDJFQEte8XCtLiIcjzu1QCfdoaF uFfqllq2K1mtyPSCW+jz6DU= =iwzz -----END PGP SIGNATURE-----
Current thread:
- [ GLSA 200710-11 ] X Font Server: Multiple Vulnerabilities Pierre-Yves Rofes (Oct 13)