Re: CVE request: X server crash by client

[Alan Coopersmith <alan.coopersmith () oracle com>]

On 04/24/15 08:00 AM, Marcus Meissner wrote:
> Hi,
>
> We got notified that the fix for CVE-2014-8092 introduced the possibility
> of a division by 0 when the "height" for the PutImage call is 0, leading
> to X server abort.
>
> https://bugzilla.novell.com/show_bug.cgi?id=928520
>
> This was already fixed in January in X git.
> http://cgit.freedesktop.org/xorg/xserver/commit/?id=dc777c346d5d452a53b13b917c45f6a1bad2f20b
>
> As this is a local denial of service, but might be triggerable by images with 0 height
> supplied externally, it might need a CVE.

Right - the ability of an already authenticated client to end the X session is
generally not considered a vulnerability in Xorg, since we provide intentional
mechanism to do so already, but doing so because an external data source (web
site, document file, etc.) provided a bad image could be.

--
        -Alan Coopersmith-              alan.coopersmith () oracle com
          X.Org Security Response Team - xorg-security () lists x org