Bugzilla – Bug 915810
VUL-0: CVE-2015-0255: xorg-x11-server: Information leak in the XkbSetGeometry request of X servers
Last modified: 2016-04-27 19:20:04 UTC
Created attachment 621610 [details] Patch for CVE-2015-0255 X.Org Security Advisory: Feb 17, 2015 - CVE-2015-0255 Information leak in the XkbSetGeometry request of X servers =========================================================== Description: ============ Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request. The issue stems from the server trusting the client to send valid string lengths in the request data. A malicious client with string lengths exceeding the request length can cause the server to copy adjacent memory data into the XKB structs. This data is then available to the client via the XkbGetGeometry request. The data length is at least up to 64k, it is possible to obtain more data by chaining strings, each string length is then determined by whatever happens to be in that 16-bit region of memory. A similarly crafted request can likely cause the X server to crash. This issue has been assigned CVE-2015-0255 Affected Versions: ================== This bug appears to have been introduced in X11R6.6 (March 1996) and is thus believed to be present in every X server release since, including the current stable release 1.16.3 Fixes: ====== A fix is available via the attached patch which is intended to be included in xorg-server-1.16.4 and 1.17.0 Thanks: ======= The X.Org Foundation thanks Olivier for bringing this issue to our attention and providing the fixes.
bugbot adjusting priority
An update workflow for this issue was started. This issue was rated as moderate. Please submit fixed packages until 2015-02-17. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/60516
So let's assign this to the security team. We can worry about openSUSE when the embargo is lifted and there are no other things to do.
public: http://www.x.org/wiki/Development/Security/Advisory-2015-02-10/
is public, please fix openSUSE
This is an autogenerated message for OBS integration: This bug (915810) was mentioned in https://build.opensuse.org/request/show/286762 13.2 / xorg-x11-server
openSUSE-SU-2015:0337-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 915810 CVE References: CVE-2015-0255 Sources used: openSUSE 13.2 (src): xorg-x11-server-7.6_1.16.1-9.1 openSUSE 13.1 (src): xorg-x11-server-7.6_1.14.3.901-16.1
openSUSE-SU-2015:0338-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 915810 CVE References: CVE-2015-0255 Sources used: openSUSE 13.2 (src): tigervnc-1.4.1-6.26.1
SUSE-SU-2015:0401-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 915810 CVE References: CVE-2015-0255 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Server 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Desktop 12 (src): xorg-x11-server-7.6_1.15.2-21.1
SUSE-SU-2015:0400-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 915810 CVE References: CVE-2015-0255 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Server 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Desktop 12 (src): xorg-x11-server-7.6_1.15.2-21.1
SUSE-SU-2015:0402-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 915810 CVE References: CVE-2015-0255 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Server 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Desktop 12 (src): xorg-x11-server-7.6_1.15.2-21.1
SUSE-SU-2015:0403-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 915810 CVE References: CVE-2015-0255 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Server 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Desktop 12 (src): xorg-x11-server-7.6_1.15.2-21.1
SUSE-SU-2015:0399-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 915810 CVE References: CVE-2015-0255 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Server 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Desktop 12 (src): xorg-x11-server-7.6_1.15.2-21.1
SUSE-SU-2015:0398-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 915810 CVE References: CVE-2015-0255 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Server 12 (src): xorg-x11-server-7.6_1.15.2-21.1 SUSE Linux Enterprise Desktop 12 (src): xorg-x11-server-7.6_1.15.2-21.1
erleased
SUSE-SU-2015:0427-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 883051,915810 CVE References: CVE-2015-0255 Sources used: SUSE Linux Enterprise Software Development Kit 11 SP3 (src): xorg-x11-server-7.4-27.103.1 SUSE Linux Enterprise Server 11 SP3 for VMware (src): xorg-x11-server-7.4-27.103.1 SUSE Linux Enterprise Server 11 SP3 (src): xorg-x11-server-7.4-27.103.1 SUSE Linux Enterprise Desktop 11 SP3 (src): xorg-x11-server-7.4-27.103.1
SUSE-SU-2015:0939-1: An update that solves one vulnerability and has four fixes is now available. Category: security (moderate) Bug References: 908738,911577,915782,915810,920969 CVE References: CVE-2015-0255 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): fltk-1.3.2-10.2 SUSE Linux Enterprise Server 12 (src): fltk-1.3.2-10.2, tigervnc-1.4.1-32.1 SUSE Linux Enterprise Desktop 12 (src): fltk-1.3.2-10.2, tigervnc-1.4.1-32.1
This is an autogenerated message for OBS integration: This bug (915810) was mentioned in https://build.opensuse.org/request/show/317024 42 / tigervnc