oss-sec mailing list archives
Re: Fwd: X.Org Security Advisory: Issues in libX11 prior to 1.8.7 & libXpm prior to 3.5.17
From: Alan Coopersmith <alan.coopersmith () oracle com>
Date: Tue, 3 Oct 2023 13:16:44 -0700
On 10/3/23 09:31, Alan Coopersmith wrote:
X.Org Security Advisory: October 3, 2023 Issues in libX11 prior to 1.8.7 & libXpm prior to 3.5.17 ========================================================
Two additional things we shared with the distros list pre-disclosure: 1) Test cases for 3 of the XPM bugs - instead of attaching them to the emails to test which of your mail readers are still vulnerable to these bugs, we've checked them in to the libXpm git repo - see the commits starting with "test" listed on: https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commits/libXpm-3.5.17?ref_type=tags (The test case for CVE-2023-43788 was already in the repo from CVE-2022-46285 from earlier this year). 2) When Dr. Duck reported the libX11 issue included in this set as CVE-2023-43785 he also reported several other bugs as potential security issues. We determined they did not meet our vulnerability criteria but fixed them as general bugs and improved hardening. If you are backporting individual patches instead of upgrading to the new releases, you may want to consider if they meet your criteria for backporting as well: https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/233 https://gitlab.freedesktop.org/xorg/lib/libxrandr/-/merge_requests/6 https://gitlab.freedesktop.org/xorg/app/xrandr/-/merge_requests/12 Each merge request contains a comment with our reasoning. Of course, our releases also contain other bug fixes & hardening besides those listed here. -- -Alan Coopersmith- alan.coopersmith () oracle com X.Org Security Response Team - xorg-security () lists x org
Current thread:
- Fwd: X.Org Security Advisory: Issues in libX11 prior to 1.8.7 & libXpm prior to 3.5.17 Alan Coopersmith (Oct 03)
- Re: Fwd: X.Org Security Advisory: Issues in libX11 prior to 1.8.7 & libXpm prior to 3.5.17 Alan Coopersmith (Oct 03)