Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

RedHat Enterprise Linux 8: RHSA-2021-1804 Moderate: X.Org Graphics Issues

red hat
Calendar Grey May 18, 2021
Dist Redhat Esm H88
Critical update alert for graphics components on Red Hat Enterprise Linux, addressing vulnerabilities in xorg-x11 and mesa packages.
An update for the userspace graphics, including X.Org, and Mesa is now available for Red Hat Enterprise Linux 8

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Summary

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.
Mesa provides a 3D graphics API that is compatible with Open Graphics Library (OpenGL). It also provides hardware-accelerated drivers for many popular graphics chips.
The following packages have been upgraded to a later upstream version: egl-wayland (1.1.5), libdrm (2.4.103), libglvnd (1.3.2), libinput (1.16.3), libwacom (1.6), mesa (20.3.3), xorg-x11-server (1.20.10). (BZ#1878160, BZ#1886648, BZ#1887654, BZ#1887655)
Security Fix(es):
* xorg-x11-server: Out-of-bounds access in XkbSetNames function (CVE-2020-14345)
* xorg-x11-server: Integer underflow in the X input extension protocol (CVE-2020-14346)
* xorg-x11-server: Out-of-bounds access in XkbSetMap function (CVE-2020-14360)
* xorg-x11-server: XkbSelectEvents integer underflow privilege escalation vulnerability (CVE-2020-14361)
* xorg-x11-server: XRecordRegisterClients integer underflow privilege escalation vulnerability (CVE-2020-14362)
* libX11: Integer overflow leads to double free in locale handling (CVE-2020-14363)
* xorg-x11-server: XkbSetDeviceInfo heap-based buffer overflow privilege escalation vulnerability (CVE-2020-25712)
* libX11: Heap overflow in the X input method client (CVE-2020-14344)
* xorg-x11-server: Leak of uninitialized heap memory from the X server to clients in AllocatePixmap of dix/pixmap.c (CVE-2020-14347)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory security issue moderate severity Red Hat Enterprise X.Org Mesa userspace graphics

References

https://access.redhat.com/security/cve/CVE-2020-14344 https://access.redhat.com/security/cve/CVE-2020-14345 https://access.redhat.com/security/cve/CVE-2020-14346 https://access.redhat.com/security/cve/CVE-2020-14347 https://access.redhat.com/security/cve/CVE-2020-14360 https://access.redhat.com/security/cve/CVE-2020-14361 https://access.redhat.com/security/cve/CVE-2020-14362 https://access.redhat.com/security/cve/CVE-2020-14363 https://access.redhat.com/security/cve/CVE-2020-25712 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.4_release_notes/

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: egl-wayland-1.1.5-3.el8.src.rpm libX11-1.6.8-4.el8.src.rpm libdrm-2.4.103-1.el8.src.rpm libglvnd-1.3.2-1.el8.src.rpm libinput-1.16.3-1.el8.src.rpm libwacom-1.6-2.el8.src.rpm mesa-20.3.3-2.el8.src.rpm xorg-x11-drivers-7.7-30.el8.src.rpm xorg-x11-server-1.20.10-1.el8.src.rpm
aarch64: drm-utils-debuginfo-2.4.103-1.el8.aarch64.rpm egl-wayland-1.1.5-3.el8.aarch64.rpm egl-wayland-debuginfo-1.1.5-3.el8.aarch64.rpm egl-wayland-debugsource-1.1.5-3.el8.aarch64.rpm libX11-1.6.8-4.el8.aarch64.rpm libX11-debuginfo-1.6.8-4.el8.aarch64.rpm libX11-debugsource-1.6.8-4.el8.aarch64.rpm libX11-devel-1.6.8-4.el8.aarch64.rpm libX11-xcb-1.6.8-4.el8.aarch64.rpm libX11-xcb-debuginfo-1.6.8-4.el8.aarch64.rpm libdrm-2.4.103-1.el8.aarch64.rpm libdrm-debuginfo-2.4.103-1.el8.aarch64.rpm libdrm-debugsource-2.4.103-1.el8.aarch64.rpm libdrm-devel-2.4.103-1.el8.aarch64.rpm libglvnd-1.3.2-1.el8.aarch64.rpm libglvnd-core-devel-1.3.2-1.el8.aarch64.rpm libglvnd-debuginfo-1.3.2-1.el8.aarch64.rpm libglvnd-debugsource-1.3.2-1.el8.aarch64.rpm libglvnd-devel-1.3.2-1.el8.aarch64.rpm libglvnd-egl-1.3.2-1.el8.aarch64.rpm libglvnd-egl-debuginfo-1.3.2-1.el8.aarch64.rpm libglvnd-gles-1.3.2-1.el8.aarch64.rpm libglvnd-gles-debuginfo-1.3.2-1.el8.aarch64.rpm

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2021:1804-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2021:1804
Issue date: 2021-05-18

Topic

An update for the userspace graphics, including X.Org, and Mesa is nowavailable for Red Hat Enterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security issue moderate severity Red Hat Enterprise X.Org Mesa userspace graphics

Relevant Releases Architectures

Red Hat CodeReady Linux Builder (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

Bugs Fixed

1826141 - egl-wayland: does not rebuild with mesa-19.3.0-3.rc4.el8

1854920 - enable build on s390x

1856738 - Bug in xf86-video-intel (xorg-x11-drv-intel) prevents iris driver from working properly when DRI2 and intel DDX driver are in use

1862241 - CVE-2020-14345 xorg-x11-server: Out-of-bounds access in XkbSetNames function

1862246 - CVE-2020-14346 xorg-x11-server: Integer underflow in the X input extension protocol

1862255 - CVE-2020-14344 libX11: Heap overflow in the X input method client

1862258 - CVE-2020-14347 xorg-x11-server: Leak of uninitialized heap memory from the X server to clients in AllocatePixmap of dix/pixmap.c

1863142 - Xorg server does not support X11 SECURITY extension

1869139 - CVE-2020-14360 xorg-x11-server: Out-of-bounds access in XkbSetMap function

1869142 - CVE-2020-14361 xorg-x11-server: XkbSelectEvents integer underflow privilege escalation vulnerability

1869144 - CVE-2020-14362 xorg-x11-server: XRecordRegisterClients integer underflow privilege escalation vulnerability

1872473 - CVE-2020-14363 libX11: integer overflow leads to double free in locale handling

1878160 - Rebase Libwacom in RHEL 8.4

1886644 - Rebuild libX11 to pick up new xorgproto symbols

1886648 - Rebase libinput in 8.4

1887276 - CVE-2020-25712 xorg-x11-server: XkbSetDeviceInfo heap-based buffer overflow privilege escalation vulnerability

1887654 - Rebase libdrm in 8.4

1887655 - Rebase mesa in 8.4

Read the Full Advisory

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here