mirror of
git://slackware.nl/current.git
synced 2024-12-29 10:25:00 +01:00
d6e7dd0417
patches/packages/xorg-server-1.20.14-x86_64-12_slack15.0.txz: Rebuilt.
This update fixes security issues:
Heap buffer overread/data leakage in ProcXIGetSelectedEvents.
Heap buffer overread/data leakage in ProcXIPassiveGrabDevice.
Heap buffer overread/data leakage in ProcAppleDRICreatePixmap.
Use-after-free in ProcRenderAddGlyphs.
For more information, see:
https://lists.x.org/archives/xorg-announce/2024-April/003497.html
https://www.cve.org/CVERecord?id=CVE-2024-31080
https://www.cve.org/CVERecord?id=CVE-2024-31081
https://www.cve.org/CVERecord?id=CVE-2024-31082
https://www.cve.org/CVERecord?id=CVE-2024-31083
(* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-x86_64-12_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-x86_64-12_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-x86_64-12_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-x86_64-11_slack15.0.txz: Rebuilt.
This update fixes security issues:
Heap buffer overread/data leakage in ProcXIGetSelectedEvents.
Heap buffer overread/data leakage in ProcXIPassiveGrabDevice.
Use-after-free in ProcRenderAddGlyphs.
For more information, see:
https://lists.x.org/archives/xorg-announce/2024-April/003497.html
https://www.cve.org/CVERecord?id=CVE-2024-31080
https://www.cve.org/CVERecord?id=CVE-2024-31081
https://www.cve.org/CVERecord?id=CVE-2024-31083
(* Security fix *)
43 lines
1.3 KiB
Diff
43 lines
1.3 KiB
Diff
From 3e77295f888c67fc7645db5d0c00926a29ffecee Mon Sep 17 00:00:00 2001
|
|
From: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
Date: Fri, 22 Mar 2024 18:56:27 -0700
|
|
Subject: [PATCH] Xi: ProcXIPassiveGrabDevice needs to use unswapped length to
|
|
send reply
|
|
|
|
CVE-2024-31081
|
|
|
|
Fixes: d220d6907 ("Xi: add GrabButton and GrabKeysym code.")
|
|
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
|
|
Part-of: <https://gitlab.freedesktop.org/xorg/xserver/-/merge_requests/1463>
|
|
---
|
|
Xi/xipassivegrab.c | 5 ++++-
|
|
1 file changed, 4 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/Xi/xipassivegrab.c b/Xi/xipassivegrab.c
|
|
index c9ac2f8553..896233bec2 100644
|
|
--- a/Xi/xipassivegrab.c
|
|
+++ b/Xi/xipassivegrab.c
|
|
@@ -93,6 +93,7 @@ ProcXIPassiveGrabDevice(ClientPtr client)
|
|
GrabParameters param;
|
|
void *tmp;
|
|
int mask_len;
|
|
+ uint32_t length;
|
|
|
|
REQUEST(xXIPassiveGrabDeviceReq);
|
|
REQUEST_FIXED_SIZE(xXIPassiveGrabDeviceReq,
|
|
@@ -247,9 +248,11 @@ ProcXIPassiveGrabDevice(ClientPtr client)
|
|
}
|
|
}
|
|
|
|
+ /* save the value before SRepXIPassiveGrabDevice swaps it */
|
|
+ length = rep.length;
|
|
WriteReplyToClient(client, sizeof(rep), &rep);
|
|
if (rep.num_modifiers)
|
|
- WriteToClient(client, rep.length * 4, modifiers_failed);
|
|
+ WriteToClient(client, length * 4, modifiers_failed);
|
|
|
|
out:
|
|
free(modifiers_failed);
|
|
--
|
|
GitLab
|
|
|