Arch Linux: 201710-29 High: xorg-server Arbitrary Code Execution

Arch Linux Security Advisory ASA-201710-29
=========================================
Severity: High
Date    : 2017-10-21
CVE-ID  : CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 CVE-2017-12183
Package : xorg-server
Type    : arbitrary code execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-443

Summary
======
The package xorg-server before version 1.19.5-1 is vulnerable to
arbitrary code execution.

Resolution
=========
Upgrade to 1.19.5-1.

# pacman -Syu "xorg-server>=1.19.5-1"

The problems have been fixed upstream in version 1.19.5.

Workaround
=========
None.

Description
==========
- CVE-2017-12176 (arbitrary code execution)

A security issue has been found in xorg-server, due to a missing
validation of the extra length in ProcEstablishConnection().

- CVE-2017-12177 (arbitrary code execution)

A security issue has been found in the double buffer extension
component of xorg-server, due to a missing validation of the length of
a variable-length request in ProcDbeGetVisualInfo().

- CVE-2017-12178 (arbitrary code execution)

A security issue has been found in the Xi component of xorg-server, due
to an invalid length check in ProcXIChangeHierarchy.

- CVE-2017-12183 (arbitrary code execution)

A security issue has been found in the xfixes component of xorg-server,
where buffer lengths were not correctly validated.

Impact
=====
An attacker able to connect to an X server, either locally or remotely,
can cause a denial of service by crashing the server, or execute
arbitrary code on the affected host.

References
=========
https://lists.x.org/archives/xorg-devel/2017-October/054871.html




https://security.archlinux.org/CVE-2017-12176
https://security.archlinux.org/CVE-2017-12177
https://security.archlinux.org/CVE-2017-12178
https://security.archlinux.org/CVE-2017-12183