mirror of
git://slackware.nl/current.git
synced 2024-12-29 10:25:00 +01:00
95fd8ef935
patches/packages/gnutls-3.8.3-x86_64-1_slack15.0.txz: Upgraded.
This update fixes two medium severity security issues:
Fix more timing side-channel inside RSA-PSK key exchange.
Fix assertion failure when verifying a certificate chain with a cycle of
cross signatures.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2024-0553
https://www.cve.org/CVERecord?id=CVE-2024-0567
(* Security fix *)
patches/packages/xorg-server-1.20.14-x86_64-11_slack15.0.txz: Rebuilt.
This update fixes security issues:
Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer.
Reattaching to different master device may lead to out-of-bounds memory access.
Heap buffer overflow in XISendDeviceHierarchyEvent.
Heap buffer overflow in DisableDevice.
SELinux context corruption.
SELinux unlabeled GLX PBuffer.
For more information, see:
https://lists.x.org/archives/xorg/2024-January/061525.html
https://www.cve.org/CVERecord?id=CVE-2023-6816
https://www.cve.org/CVERecord?id=CVE-2024-0229
https://www.cve.org/CVERecord?id=CVE-2024-21885
https://www.cve.org/CVERecord?id=CVE-2024-21886
https://www.cve.org/CVERecord?id=CVE-2024-0408
https://www.cve.org/CVERecord?id=CVE-2024-0409
(* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-x86_64-11_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-x86_64-11_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-x86_64-11_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-x86_64-10_slack15.0.txz: Rebuilt.
This update fixes security issues:
Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer.
Reattaching to different master device may lead to out-of-bounds memory access.
Heap buffer overflow in XISendDeviceHierarchyEvent.
Heap buffer overflow in DisableDevice.
SELinux unlabeled GLX PBuffer.
For more information, see:
https://lists.x.org/archives/xorg/2024-January/061525.html
https://www.cve.org/CVERecord?id=CVE-2023-6816
https://www.cve.org/CVERecord?id=CVE-2024-0229
https://www.cve.org/CVERecord?id=CVE-2024-21885
https://www.cve.org/CVERecord?id=CVE-2024-21886
https://www.cve.org/CVERecord?id=CVE-2024-0408
(* Security fix *)
51 lines
1.9 KiB
Diff
51 lines
1.9 KiB
Diff
From 9e2ecb2af8302dedc49cb6a63ebe063c58a9e7e3 Mon Sep 17 00:00:00 2001
|
|
From: Peter Hutterer <peter.hutterer@who-t.net>
|
|
Date: Thu, 14 Dec 2023 11:29:49 +1000
|
|
Subject: [PATCH] dix: allocate enough space for logical button maps
|
|
|
|
Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for
|
|
each logical button currently down. Since buttons can be arbitrarily mapped
|
|
to anything up to 255 make sure we have enough bits for the maximum mapping.
|
|
|
|
CVE-2023-6816, ZDI-CAN-22664, ZDI-CAN-22665
|
|
|
|
This vulnerability was discovered by:
|
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
|
---
|
|
Xi/xiquerypointer.c | 3 +--
|
|
dix/enterleave.c | 5 +++--
|
|
2 files changed, 4 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/Xi/xiquerypointer.c b/Xi/xiquerypointer.c
|
|
index 5b77b1a444..2b05ac5f39 100644
|
|
--- a/Xi/xiquerypointer.c
|
|
+++ b/Xi/xiquerypointer.c
|
|
@@ -149,8 +149,7 @@ ProcXIQueryPointer(ClientPtr client)
|
|
if (pDev->button) {
|
|
int i;
|
|
|
|
- rep.buttons_len =
|
|
- bytes_to_int32(bits_to_bytes(pDev->button->numButtons));
|
|
+ rep.buttons_len = bytes_to_int32(bits_to_bytes(256)); /* button map up to 255 */
|
|
rep.length += rep.buttons_len;
|
|
buttons = calloc(rep.buttons_len, 4);
|
|
if (!buttons)
|
|
diff --git a/dix/enterleave.c b/dix/enterleave.c
|
|
index 867ec74363..ded8679d76 100644
|
|
--- a/dix/enterleave.c
|
|
+++ b/dix/enterleave.c
|
|
@@ -784,8 +784,9 @@ DeviceFocusEvent(DeviceIntPtr dev, int type, int mode, int detail,
|
|
|
|
mouse = IsFloating(dev) ? dev : GetMaster(dev, MASTER_POINTER);
|
|
|
|
- /* XI 2 event */
|
|
- btlen = (mouse->button) ? bits_to_bytes(mouse->button->numButtons) : 0;
|
|
+ /* XI 2 event contains the logical button map - maps are CARD8
|
|
+ * so we need 256 bits for the possibly maximum mapping */
|
|
+ btlen = (mouse->button) ? bits_to_bytes(256) : 0;
|
|
btlen = bytes_to_int32(btlen);
|
|
len = sizeof(xXIFocusInEvent) + btlen * 4;
|
|
|
|
--
|
|
GitLab
|
|
|