Skip to Content.
Sympa Menu

sm-security - [SM-Security] xorg, xfree86, xfree86-4.3: overflow in pixmap allocation

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas HOUSSIN <thomas.houssin AT gmail.com>
  • To: sm-security <sm-security AT lists.ibiblio.org>
  • Subject: [SM-Security] xorg, xfree86, xfree86-4.3: overflow in pixmap allocation
  • Date: Wed, 21 Sep 2005 12:29:30 +0200

Synopsis
========
A vulnerability was discovered in the pixmap allocation handling of
the X server that can lead to local privilege escalation.

Background
==========
xfree86 and xorg are two implementations of the X Window System.

Description
===========
CAN-2005-2495:
Integer overflow in XFree86 and xorg allow user-complicit attackers
to execute arbitrary code via a crafted pixmap image.

Impact
======
By allocating a huge pixmap, a local user could trigger an integer
overflow that resulted in a memory allocation that was too small for
the requested pixmap, leading to a buffer overflow which could then be
exploited to execute arbitrary code with full root privileges.

Workaround
==========
There are no known workarounds at this time.

Affected packages
=================
xorg, xfree86 and xfree86-4.3 in all grimoires are affected. This is
now fixed in devel, test,
stable-rc/0.2 and stable/0.1 grimoires.

Resolution
==========
All users should upgrade to the latest available version:
- for xorg users:
# scribe update
# cast -c xorg
- for xfree86 users:
# scribe update
# cast -c xfree86
- for xfree86-4.3 users:
# scribe update
# cast -c xfree86-4.3

References
==========
[ 1 ] CAN-2005-2495
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2495
[ 2 ] Freedesktop Bugzilla Bug 594
https://bugs.freedesktop.org/show_bug.cgi?id=594
[ 3 ] MDKSA-2005:164
http://www.mandriva.com/security/advisories?name=MDKSA-2005:164

--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36



  • [SM-Security] xorg, xfree86, xfree86-4.3: overflow in pixmap allocation, Thomas HOUSSIN, 09/21/2005

Archive powered by MHonArc 2.6.24.

Top of Page