ArchLinux: 201708-11: xorg-server: multiple issues
Summary
- CVE-2017-10971 (arbitrary code execution)
In the X.Org X server on v.1.19.3, a user authenticated to an X Session
could crash or execute code in the context of the X Server by
exploiting a stack overflow in the endianness conversion of X Events.
- CVE-2017-10972 (information disclosure)
Uninitialized data in endianness conversion in the XEvent handling of
the X.Org X Server on v1.19.3 and before allowed authenticated
malicious users to access potentially privileged data from the X
server.
Resolution
Upgrade to 1.19.3-3.
# pacman -Syu "xorg-server>=1.19.3-3"
The problems have been fixed upstream but no release is available yet.
References
https://bugzilla.suse.com/show_bug.cgi?id=1035283 https://cgit.freedesktop.org/xorg/xserver/commit/?id=215f894965df5fb0bb45b107d84524e700d2073c https://cgit.freedesktop.org/xorg/xserver/commit/?id=8caed4df36b1f802b4992edcfd282cbeeec35d9d https://cgit.freedesktop.org/xorg/xserver/commit/?id=ba336b24052122b136486961c82deac76bbde455 https://cgit.freedesktop.org/xorg/xserver/commit/?id=05442de962d3dc624f79fc1a00eca3ffc5489ced https://security.archlinux.org/CVE-2017-10971 https://security.archlinux.org/CVE-2017-10972
Workaround
None.