bugtraq - [ MDVSA-2008:025 ] - Updated x11-server-xgl packages fix multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-id: <E1JHvpY-0000RI-DB@artemis.annvix.ca>
Date: Wed, 23 Jan 2008 23:44:56 -0700
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2008:025 ] - Updated x11-server-xgl packages fix multiple
 vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2008:025
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : x11-server-xgl
 Date    : January 23, 2008
 Affected: 2007.0, 2007.1, 2008.0
 _______________________________________________________________________

 Problem Description:

 An input validation flaw was found in the X.org server's XFree86-Misc
 extension that could allow a malicious authorized client to cause
 a denial of service (crash), or potentially execute arbitrary code
 with root privileges on the X.org server (CVE-2007-5760).

 A flaw was found in the X.org server's XC-SECURITY extension that
 could allow a local user to verify the existence of an arbitrary file,
 even in directories that are not normally accessible to that user
 (CVE-2007-5958).

 A memory corruption flaw was found in the X.org server's XInput
 extension that could allow a malicious authorized client to cause a
 denial of service (crash) or potentially execute arbitrary code with
 root privileges on the X.org server (CVE-2007-6427).

 An information disclosure flaw was found in the X.org server's TOG-CUP
 extension that could allow a malicious authorized client to cause
 a denial of service (crash) or potentially view arbitrary memory
 content within the X.org server's address space (CVE-2007-6428).

 Two integer overflow flaws were found in the X.org server's EVI and
 MIT-SHM modules that could allow a malicious authorized client to
 cause a denial of service (crash) or potentially execute arbitrary
 code with the privileges of the X.org server (CVE-2007-6429).

 The updated packages have been patched to correct these issues.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5760
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5958
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429
 _______________________________________________________________________

 Updated Packages:

 Mandriva Linux 2007.0:
 dd641b0925b43a3c6db839717424f150  2007.0/i586/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.i586.rpm 
 3747f570ab5133bc33992aa6eb88119b  2007.0/SRPMS/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 8d451268a57d8994f0ce0cf04f830ccf  2007.0/x86_64/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.x86_64.rpm 
 3747f570ab5133bc33992aa6eb88119b  2007.0/SRPMS/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 5984120f81b569ed1d5ce33a4b99811c  2007.1/i586/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.i586.rpm 
 d5ea53e985f860f4283a31871e92cb24  2007.1/SRPMS/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 844815151b636f617544c15327d79c23  2007.1/x86_64/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.x86_64.rpm 
 d5ea53e985f860f4283a31871e92cb24  2007.1/SRPMS/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.src.rpm

 Mandriva Linux 2008.0:
 ee6ed1d6886652fc18672979d22a32d7  2008.0/i586/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.i586.rpm 
 9eb1f98a29c53dcd3226b5ac5a8e28c7  2008.0/SRPMS/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 67d964ead0d0f93df039c4d06ebf1b8c  2008.0/x86_64/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.x86_64.rpm 
 9eb1f98a29c53dcd3226b5ac5a8e28c7  2008.0/SRPMS/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHmAl6mqjQ0CJFipgRAngpAJ46CwvieuNFdn+cdGTfjxFOLgVW2gCghV9B
BcCpDxAjOd8uqLpJaujN7BI=
=PkXK
-----END PGP SIGNATURE-----