Public SourceMage Discussion List

["Bob Cottingham" <bobcottingham AT hotmail.com>]

Saw this on the xfree86 Xpert mailing list 
(http://www.xfree86.org/pipermail/xpert/2002-September/020437.html).  Sounds 
like we need to upgrade.  I'll submit to bugzilla.

(copied message below)

[Xpert]XFree86 4.2.1 update release and Xlib security problem
David Dawes xpert AT XFree86.Org
Wed, 4 Sep 2002 21:40:32 -0400

---------------------------------------------------------------

XFree86 4.2.1 is now available.  This is an update release, intended
primarily to address some security issues.  Release notes can be found
at <http://www.xfree86.org/4.2.1/RELNOTES.html>, and other information
can be found at <http://www.xfree86.org/4.2.1/README.html> and
<http://www.xfree86.org/4.2.1/Install.html>.  A summary of security
updates can be found at <http://www.xfree86.org/security/>.  XFree86 4.2.1
is available at <ftp://ftp.xfree86.org/pub/XFree86/4.2.1/>.

The main security problem that prompted this release is a vulnerability
in the Xlib modular i18n support that was added in XFree86 4.2.0.  It
makes it possible to cause a privileged Xlib client to load and execute
arbitrary code.  In the worst case this can be exploited locally to
obtain a root shell.

Releases of XFree86 prior to 4.2.0 do not have this problem.  The XFree86
CVS trunk and xf-4_2-branch have this fixed as of today.  A patch for
4.2.0 correcting just this problem can be found at
<ftp://ftp.xfree86.org/pub/XFree86/4.2.0/fixes/4.2.0-xlib-security.patch>.

David
--
David Dawes
Release Engineer/Architect                      The XFree86 Project
www.XFree86.org/~dawes



_________________________________________________________________
MSN Photos is the easiest way to share and print your photos: 
http://photos.msn.com/support/worldwide.aspx