Vulnerability CVE-2017-13723: Information
Description
In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.
Severity: HIGH (7.8) Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| xorg-server | sisyphus | 1.19.4-alt1 | 21.1.13-alt1 | ALT-PU-2017-2383-1 | 190364 | Fixed |
| xorg-server | p10 | 1.19.4-alt1 | 1.20.14-alt13 | ALT-PU-2017-2383-1 | 190364 | Fixed |
| xorg-server | p9 | 1.19.4-alt1 | 1.20.8-alt12 | ALT-PU-2017-2383-1 | 190364 | Fixed |
| xorg-server | p8 | 1.18.4-alt1.M80P.5 | 1.19.7-alt0.M80P.1 | ALT-PU-2017-2384-1 | 190283 | Fixed |
| xorg-server | c10f1 | 1.19.4-alt1 | 1.20.14-alt12 | ALT-PU-2017-2383-1 | 190364 | Fixed |
| xorg-server | c9f2 | 1.19.4-alt1 | 1.20.8-alt12 | ALT-PU-2017-2383-1 | 190364 | Fixed |
| xorg-server | c7 | 1.14.5-alt3.M70C.1 | 1.14.5-alt3.M70C.4 | ALT-PU-2017-2407-1 | 190547 | Fixed |
| xorg-server | p11 | 1.19.4-alt1 | 21.1.13-alt1 | ALT-PU-2017-2383-1 | 190364 | Fixed |
References to Advisories, Solutions, and Tools
Hyperlink | Resource |
|---|---|
| [xorg-announce] 20171004 [ANNOUNCE] xorg-server 1.19.4 |
|
| https://cgit.freedesktop.org/xorg/xserver/commit/?id=94f11ca5cf011ef123bd222cabeaef6f424d76ac |
|
| [oss-security] 20171004 Fwd: X server fixes for CVE-2017-13721 & CVE-2017-13723 |
|
| 101253 |
|
| GLSA-201710-30 |
|
| DSA-4000 |
|
| [debian-lts-announce] 20171122 [SECURITY] [DLA 1186-1] xorg-server security update |