ASA-201710-29 log original external raw

[ASA-201710-29] xorg-server: arbitrary code execution
Arch Linux Security Advisory ASA-201710-29 ========================================== Severity: High Date : 2017-10-21 CVE-ID : CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12183 Package : xorg-server Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-443 Summary ======= The package xorg-server before version 1.19.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.19.5-1. # pacman -Syu "xorg-server>=1.19.5-1" The problems have been fixed upstream in version 1.19.5. Workaround ========== None. Description =========== - CVE-2017-12176 (arbitrary code execution) A security issue has been found in xorg-server, due to a missing validation of the extra length in ProcEstablishConnection(). - CVE-2017-12177 (arbitrary code execution) A security issue has been found in the double buffer extension component of xorg-server, due to a missing validation of the length of a variable-length request in ProcDbeGetVisualInfo(). - CVE-2017-12178 (arbitrary code execution) A security issue has been found in the Xi component of xorg-server, due to an invalid length check in ProcXIChangeHierarchy. - CVE-2017-12183 (arbitrary code execution) A security issue has been found in the xfixes component of xorg-server, where buffer lengths were not correctly validated. Impact ====== An attacker able to connect to an X server, either locally or remotely, can cause a denial of service by crashing the server, or execute arbitrary code on the affected host. References ========== https://lists.x.org/archives/xorg-devel/2017-October/054871.html https://cgit.freedesktop.org/xorg/xserver/commit/?id=b747da5e25be944337a9cd1415506fc06b70aa81 https://cgit.freedesktop.org/xorg/xserver/commit/?id=4ca68b878e851e2136c234f40a25008297d8d831 https://cgit.freedesktop.org/xorg/xserver/commit/?id=859b08d523307eebde7724fd1a0789c44813e821 https://cgit.freedesktop.org/xorg/xserver/commit/?id=55caa8b08c84af2b50fbc936cf334a5a93dd7db5 https://security.archlinux.org/CVE-2017-12176 https://security.archlinux.org/CVE-2017-12177 https://security.archlinux.org/CVE-2017-12178 https://security.archlinux.org/CVE-2017-12183

[ASA-201710-29] xorg-server: arbitrary code execution

Arch Linux Security Advisory ASA-201710-29 ========================================== Severity: High Date : 2017-10-21 CVE-ID : CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12183 Package : xorg-server Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-443 Summary ======= The package xorg-server before version 1.19.5-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 1.19.5-1. # pacman -Syu "xorg-server>=1.19.5-1" The problems have been fixed upstream in version 1.19.5. Workaround ========== None. Description =========== - CVE-2017-12176 (arbitrary code execution) A security issue has been found in xorg-server, due to a missing validation of the extra length in ProcEstablishConnection(). - CVE-2017-12177 (arbitrary code execution) A security issue has been found in the double buffer extension component of xorg-server, due to a missing validation of the length of a variable-length request in ProcDbeGetVisualInfo(). - CVE-2017-12178 (arbitrary code execution) A security issue has been found in the Xi component of xorg-server, due to an invalid length check in ProcXIChangeHierarchy. - CVE-2017-12183 (arbitrary code execution) A security issue has been found in the xfixes component of xorg-server, where buffer lengths were not correctly validated. Impact ====== An attacker able to connect to an X server, either locally or remotely, can cause a denial of service by crashing the server, or execute arbitrary code on the affected host. References ========== https://lists.x.org/archives/xorg-devel/2017-October/054871.html https://cgit.freedesktop.org/xorg/xserver/commit/?id=b747da5e25be944337a9cd1415506fc06b70aa81 https://cgit.freedesktop.org/xorg/xserver/commit/?id=4ca68b878e851e2136c234f40a25008297d8d831 https://cgit.freedesktop.org/xorg/xserver/commit/?id=859b08d523307eebde7724fd1a0789c44813e821 https://cgit.freedesktop.org/xorg/xserver/commit/?id=55caa8b08c84af2b50fbc936cf334a5a93dd7db5 https://security.archlinux.org/CVE-2017-12176 https://security.archlinux.org/CVE-2017-12177 https://security.archlinux.org/CVE-2017-12178 https://security.archlinux.org/CVE-2017-12183