This is an automated email from the git hooks/post-receive script. x2go pushed a commit to branch 3.5.0.x in repository nx-libs. commit 650181c23b32378b4ec829880cc20700bf5b2ddf Author: Mihai Moldovan <ionic@ionic.de> Date: Mon Feb 16 09:40:16 2015 +0100 CVE security review: Add 1041-nx-X11-lib-font-fc-fserve.c-initialize-remaining-buf.patch & 1042-Do-proper-input-validation-to-fix-for-CVE-2011-2895.patch. - Add 1041-nx-X11-lib-font-fc-fserve.c-initialize-remaining-buf.patch. Initialize remaining bufleft variables (nx-X11/lib/font/fc/fserve.c). - Add 1042-Do-proper-input-validation-to-fix-for-CVE-2011-2895.patch. Do proper input validation to fix for CVE-2011-2895. --- debian/changelog | 4 ++++ ...font-fc-fserve.c-initialize-remaining-buf.patch | 2 +- ...input-validation-to-fix-for-CVE-2011-2895.patch | 2 +- debian/patches/series | 2 ++ 4 files changed, 8 insertions(+), 2 deletions(-) diff --git a/debian/changelog b/debian/changelog index 4f6833d..523d7a5 100644 --- a/debian/changelog +++ b/debian/changelog @@ -204,6 +204,10 @@ nx-libs (2:3.5.0.29-0x2go2) UNRELEASED; urgency=medium Apply correctly on nx-libs 3.6.x. - Update 1020-dix-integer-overflow-in-GetHosts-CVE-2014-8092-2-4.patch. Human-readable version of "1 MB". + - Add 1041-nx-X11-lib-font-fc-fserve.c-initialize-remaining-buf.patch. + Initialize remaining bufleft variables (nx-X11/lib/font/fc/fserve.c). + - Add 1042-Do-proper-input-validation-to-fix-for-CVE-2011-2895.patch. + Do proper input validation to fix for CVE-2011-2895. -- Mike Gabriel <mike.gabriel@das-netzwerkteam.de> Thu, 13 Nov 2014 21:59:00 +0100 diff --git a/debian/patches/1041-nx-X11-lib-font-fc-fserve.c-initialize-remaining-buf.patch b/debian/patches/1041-nx-X11-lib-font-fc-fserve.c-initialize-remaining-buf.patch index 4203bf6..b74b2d4 100644 --- a/debian/patches/1041-nx-X11-lib-font-fc-fserve.c-initialize-remaining-buf.patch +++ b/debian/patches/1041-nx-X11-lib-font-fc-fserve.c-initialize-remaining-buf.patch @@ -1,7 +1,7 @@ From b04f11915e29d9563d279e1326f61b50ea414dba Mon Sep 17 00:00:00 2001 From: Mihai Moldovan <ionic@ionic.de> Date: Mon, 16 Feb 2015 06:03:48 +0100 -Subject: [PATCH 07/15] nx-X11/lib/font/fc/fserve.c: initialize remaining +Subject: [PATCH 01/02] nx-X11/lib/font/fc/fserve.c: initialize remaining bufleft variables. --- diff --git a/debian/patches/1042-Do-proper-input-validation-to-fix-for-CVE-2011-2895.patch b/debian/patches/1042-Do-proper-input-validation-to-fix-for-CVE-2011-2895.patch index 9e5d00e..0491035 100644 --- a/debian/patches/1042-Do-proper-input-validation-to-fix-for-CVE-2011-2895.patch +++ b/debian/patches/1042-Do-proper-input-validation-to-fix-for-CVE-2011-2895.patch @@ -1,7 +1,7 @@ From 6acafc9334828da22446380c81af81bde14b5d86 Mon Sep 17 00:00:00 2001 From: Joerg Sonnenberger <joerg@britannica.bec.de> Date: Sun, 21 Aug 2011 18:51:53 +0200 -Subject: [PATCH 08/15] Do proper input validation to fix for CVE-2011-2895. +Subject: [PATCH 02/02] Do proper input validation to fix for CVE-2011-2895. It ensures that all valid input can be decompressed, checks that the overflow conditions doesn't happen and generally tightens the diff --git a/debian/patches/series b/debian/patches/series index c31d33d..379704c 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -112,5 +112,7 @@ 1038-glx-Length-checking-for-non-generated-single-request.patch 1039-glx-Length-checking-for-RenderLarge-requests-v2-CVE-.patch 1040-glx-Pass-remaining-request-length-into-varsize-v2-CV.patch +1041-nx-X11-lib-font-fc-fserve.c-initialize-remaining-buf.patch +1042-Do-proper-input-validation-to-fix-for-CVE-2011-2895.patch 0016_nx-X11_install-location.debian.patch 0102_xserver-xext_set-securitypolicy-path.debian.patch -- Alioth's /srv/git/_hooks_/post-receive-email on /srv/git/code.x2go.org/nx-libs.git