[oe-commits] Li Zhou : xorg-server: Security Advisory - xorg-server - CVE-2015-0255
git at git.openembedded.org
git at git.openembedded.org
Fri Apr 10 13:49:03 UTC 2015
Module: openembedded-core.git
Branch: master-next
Commit: 564e2f9732ac4318bb5923dd1ff771514c9afd2f
URL: http://git.openembedded.org/?p=openembedded-core.git&a=commit;h=564e2f9732ac4318bb5923dd1ff771514c9afd2f
Author: Li Zhou <li.zhou at windriver.com>
Date: Tue Apr 7 15:49:56 2015 +0800
xorg-server: Security Advisory - xorg-server - CVE-2015-0255
Updated x11-server packages fix security vulnerability:
Olivier Fourdan from Red Hat has discovered a protocol handling issue in
the way the X server code base handles the XkbSetGeometry request, where
the server trusts the client to send valid string lengths. A malicious
client with string lengths exceeding the request length can cause the server
to copy adjacent memory data into the XKB structs. This data is then
available to the client via the XkbGetGeometry request. This can lead to
information disclosure issues, as well as possibly a denial of service if a
similar request can cause the server to crash (CVE-2015-0255).
Signed-off-by: Li Zhou <li.zhou at windriver.com>
Signed-off-by: Richard Purdie <richard.purdie at linuxfoundation.org>
---
...Check-strings-length-against-request-size.patch | 145 +++++++++++++++++++++
...wap-XkbSetGeometry-data-in-the-input-buff.patch | 109 ++++++++++++++++
.../xorg-xserver/xserver-xorg_1.16.3.bb | 2 +
3 files changed, 256 insertions(+)
Diff: http://git.openembedded.org/?p=openembedded-core.git/?a=commitdiff;h=564e2f9732ac4318bb5923dd1ff771514c9afd2f
More information about the Openembedded-commits
mailing list