New libXres packages are available for Slackware 14.1, 14.2, and -current to fix a security issue. . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] libXres (SSA:2017-291-01) New libXres packages are available for Slackware 14.1, 14.2, and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/libXres-1.2.0-i586-1_slack14.2.txz: Upgraded. Integer overflows may allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XResQueryClients and (2) XResQueryClientResources functions. For more information, see: https://www.cve.org/CVERecord?id=CVE-2013-1988 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating FTP and rsync hosting to the Slackware project! :-) Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you. Updated package for Slackware 14.1: ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/libXres-1.2.0-i486-1_slack14.1.txz Updated package for Slackware x86_64 14.1: ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/libXres-1.2.0-x86_64-1_slack14.1.txz Updated package for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/libXres-1.2.0-i586-1_slack14.2.txz Updated package for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/libXres-1.2.0-x86_64-1_slack14.2.txz Updated package for Slackware -current: Updated package for Slackware x86_64 -current: MD5 signatures: +-------------+ Slackware 14.1 package: 1253ba59f7e08295d24a434a75faf448 libXres-1.2.0-i486-1_slack14.1.txz Slackware x86_64 14.1 package: f42004623a5f42c6280bf540decadb81 libXres-1.2.0-x86_64-1_slack14.1.txz Slackware 14.2package: 4256978c619753254402fc77ca2fc1fc libXres-1.2.0-i586-1_slack14.2.txz Slackware x86_64 14.2 package: 2e1e0fea3a504c181e58cb5bfc0cf22a libXres-1.2.0-x86_64-1_slack14.2.txz Slackware -current package: 9cfb1ab01a0178323c37a518621ff02b x/libXres-1.2.0-i586-1.txz Slackware x86_64 -current package: 8bcf91141af69be10620e6e4f529b0c5 x/libXres-1.2.0-x86_64-1.txz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg libXres-1.2.0-i586-1_slack14.2.txz +-----+ . Recent libXres updates issued to address security vulnerabilities related to buffer overflow concerns in various Slackware editions.. libXres, Slackware Packages, Buffer Overflow, Security Patch, Update. . LinuxSecurity.com Team
Several security issues were fixed in libxres.. =========================================================================Ubuntu Security Notice USN-1864-1 June 05, 2013 libxres vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 13.04 - Ubuntu 12.10 - Ubuntu 12.04 LTS Summary: Several security issues were fixed in libxres. Software Description: - libxres: X11 Resource extension library Details: Ilja van Sprundel discovered multiple security issues in various X.org libraries and components. An attacker could use these issues to cause applications to crash, resulting in a denial of service, or possibly execute arbitrary code. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 13.04: libxres1 2:1.0.6-1ubuntu0.13.04.1 Ubuntu 12.10: libxres1 2:1.0.6-1ubuntu0.12.10.1 Ubuntu 12.04 LTS: libxres1 2:1.0.5-1ubuntu0.1 After a standard system update you need to restart your session to make all the necessary changes. References: https://ubuntu.com/security/notices/USN-1864-1 CVE-2013-1988 Package Information: https://launchpad.net/ubuntu/+source/libxres/2:1.0.6-1ubuntu0.13.04.1 https://launchpad.net/ubuntu/+source/libxres/2:1.0.6-1ubuntu0.12.10.1 https://launchpad.net/ubuntu/+source/libxres/2:1.0.5-1ubuntu0.1 . Important updates released for libxres to address security vulnerabilities in Ubuntu versions 12.04, 12.10, and 13.04. Please ensure your system is updated immediately.. libxres vulnerability, ubuntu security notice, X11 resource extension. . Severity: Critical. LinuxSecurity.com Team
Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2688-1
Get the latest Linux and open source security news straight to your inbox.