RHSA-2014:1436 - Security Advisory

Topic

Updated X11 client libraries packages that fix multiple security issues,
several bugs, and add various enhancements are now available for Red Hat
Enterprise Linux 6.

Red Hat Product Security has rated this update as having Moderate security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

Description

The X11 (Xorg) libraries provide library routines that are used within all
X Window applications.

Multiple integer overflow flaws, leading to heap-based buffer overflows,
were found in the way various X11 client libraries handled certain protocol
data. An attacker able to submit invalid protocol data to an X11 server via
a malicious X11 client could use either of these flaws to potentially
escalate their privileges on the system. (CVE-2013-1981, CVE-2013-1982,
CVE-2013-1983, CVE-2013-1984, CVE-2013-1985, CVE-2013-1986, CVE-2013-1987,
CVE-2013-1988, CVE-2013-1989, CVE-2013-1990, CVE-2013-1991, CVE-2013-2003,
CVE-2013-2062, CVE-2013-2064)

Multiple array index errors, leading to heap-based buffer out-of-bounds
write flaws, were found in the way various X11 client libraries handled
data returned from an X11 server. A malicious X11 server could possibly use
this flaw to execute arbitrary code with the privileges of the user running
an X11 client. (CVE-2013-1997, CVE-2013-1998, CVE-2013-1999, CVE-2013-2000,
CVE-2013-2001, CVE-2013-2002, CVE-2013-2066)

A buffer overflow flaw was found in the way the XListInputDevices()
function of X.Org X11's libXi runtime library handled signed numbers.
A malicious X11 server could possibly use this flaw to execute arbitrary
code with the privileges of the user running an X11 client. (CVE-2013-1995)

A flaw was found in the way the X.Org X11 libXt runtime library used
uninitialized pointers. A malicious X11 server could possibly use this flaw
to execute arbitrary code with the privileges of the user running an X11
client. (CVE-2013-2005)

Two stack-based buffer overflow flaws were found in the way libX11, the
Core X11 protocol client library, processed certain user-specified files.
A malicious X11 server could possibly use this flaw to crash an X11 client
via a specially crafted file. (CVE-2013-2004)

The xkeyboard-config package has been upgraded to upstream version 2.11,
which provides a number of bug fixes and enhancements over the previous
version. (BZ#1077471)

This update also fixes the following bugs:

• Previously, updating the mesa-libGL package did not update the libX11

package, although it was listed as a dependency of mesa-libGL. This bug has
been fixed and updating mesa-libGL now updates all dependent packages as
expected. (BZ#1054614)

• Previously, closing a customer application could occasionally cause the X

Server to terminate unexpectedly. After this update, the X Server no longer
hangs when a user closes a customer application. (BZ#971626)

All X11 client libraries users are advised to upgrade to these updated
packages, which correct these issues and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 959040 - CVE-2013-1981 libX11: Multiple integer overflows leading to heap-based buffer-overflows
• BZ - 959046 - CVE-2013-1982 libXext: Multiple integer overflows leading to heap-based buffer-overflows
• BZ - 959048 - CVE-2013-1983 libXfixes: Integer overflow leading to heap-based buffer overflow
• BZ - 959049 - CVE-2013-1984 libXi: Multiple integer overflows leading to heap-based buffer-overflows
• BZ - 959056 - CVE-2013-1985 libXinerama: Integer overflow leading to heap-based buffer overflow
• BZ - 959059 - CVE-2013-1986 libXrandr: Multiple integer overflows leading to heap-based bufer overflows
• BZ - 959061 - CVE-2013-1987 libXrender: Multiple integer overflows leading to heap-based bufer overflows
• BZ - 959066 - CVE-2013-1988 libXRes: Multiple integer overflows leading to heap-based bufer overflows
• BZ - 959068 - CVE-2013-1989 libXv: Multiple integer overflows leading to heap-based bufer overflows
• BZ - 959070 - CVE-2013-1990 libXvMC: Multiple integer overflows leading to heap-based buffer overflows
• BZ - 959072 - CVE-2013-1991 libXxf86dga: Multiple integer overflows leading to heap-based buffer overflows
• BZ - 959077 - CVE-2013-2003 libXcursor: Integer overflow leading to heap-based buffer overflow
• BZ - 959108 - CVE-2013-2005 libXt: Memory corruption due to unchecked use of unchecked function pointers
• BZ - 959112 - CVE-2013-2004 libX11: unbounded recursion leading to stack-overflow
• BZ - 960345 - CVE-2013-1997 libX11: Multiple Array Index error leading to heap-based OOB write
• BZ - 960346 - CVE-2013-1998 libXi: Multiple Array Index error leading to heap-based OOB write
• BZ - 960347 - CVE-2013-1999 libXvMC: Array Index error leading to heap-based OOB write
• BZ - 960349 - CVE-2013-2000 libXxf86dga: Array Index error leading to heap-based OOB write
• BZ - 960350 - CVE-2013-2001 libXxf86vm: Multiple Array Index error leading to heap-based OOB write
• BZ - 960352 - CVE-2013-2002 libXt: Array Index error leading to heap-based OOB write
• BZ - 960357 - CVE-2013-1995 libXi: Sign extension issues resulting in heap-based buffer overflow
• BZ - 960362 - CVE-2013-2062 libXp: Integer overflow leading to heap-based buffer overflow
• BZ - 960367 - CVE-2013-2064 libxcb: Integer overflow leading to heap-based buffer overflow
• BZ - 960369 - CVE-2013-2066 libXv: Array Index error leading to heap-based OOB write
• BZ - 971626 - Closing an in-house app can occasionally hang the X server
• BZ - 1119322 - %{dist} found instead of %{?dist} in: libXi-1.7.2-2.1.el6.src.rpm.spec

CVEs

• CVE-2013-2062
• CVE-2013-2064
• CVE-2013-2066
• CVE-2013-2003
• CVE-2013-2002
• CVE-2013-2001
• CVE-2013-2000
• CVE-2013-2005
• CVE-2013-2004
• CVE-2013-1989
• CVE-2013-1988
• CVE-2013-1987
• CVE-2013-1986
• CVE-2013-1985
• CVE-2013-1984
• CVE-2013-1983
• CVE-2013-1982
• CVE-2013-1981
• CVE-2013-1998
• CVE-2013-1999
• CVE-2013-1990
• CVE-2013-1991
• CVE-2013-1995
• CVE-2013-1997
• CVE-2013-1992
• CVE-2013-2063

References

• https://access.redhat.com/security/updates/classification/#moderate
• http://www.x.org/wiki/Development/Security/Advisory-2013-05-23/