ArchLinux: 202012-6: xorg-server: arbitrary code execution
Summary
- CVE-2020-14360 (arbitrary code execution)
A security issue was discovered in xorg-server before 1.20.10.
Insufficient checks on the lengths of the XkbSetMap request can lead to
out of bounds memory accesses in the X server. This issue can lead to
privilege escalation for authorized clients on systems where the X
server is running privileged.
- CVE-2020-25712 (arbitrary code execution)
A security issue was discovered in xorg-server before 1.20.10.
Insufficient checks on input of the XkbSetDeviceInfo request can lead
to a buffer overflow on the head in the X server. This issue can lead
to privilege escalation for authorized clients on systems where the X
server is running privileged.
Resolution
Upgrade to 1.20.10-1.
# pacman -Syu "xorg-server>=1.20.10-1"
The problems have been fixed upstream in version 1.20.10.
References
https://www.openwall.com/lists/oss-security/2020/12/01/3 https://gitlab.freedesktop.org/xorg/xserver/-/commit/446ff2d3177087b8173fa779fa5b77a2a128988b https://gitlab.freedesktop.org/xorg/xserver/-/commit/87c64fc5b0db9f62f4e361444f4b60501ebf67b9 https://security.archlinux.org/CVE-2020-14360 https://security.archlinux.org/CVE-2020-25712
Workaround
None.