x2go-dev February 2015

x2go-dev@lists.x2go.org

28 participants
202 discussions

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 23/52: CVE-2014-0210: unvalidated length fields in fs_read_query_info() from xorg/lib/libXfont commit 491291cabf78efdeec8f18b09e14726a9030cc8f
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit c6aebf9284855a0e24ad9c5ffdd36aa65e16bec7 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 22:08:09 2015 -0500 > > CVE-2014-0210: unvalidated length fields in fs_read_query_info() from xorg/lib/libXfont commit 491291cabf78efdeec8f18b09e14726a9030cc8f > > fs_read_query_info() parses a reply from the font server. The reply > contains embedded length fields, none of which are validated. This > can cause out of bound reads in either fs_read_query_info() or in > _fs_convert_props() which it calls to parse the fsPropInfo in the reply. > --- > nx-X11/lib/font/fc/fsconvert.c | 19 ++++++++++++++----- > nx-X11/lib/font/fc/fserve.c | 40 ++++++++++++++++++++++++++++++++++++++-- > 2 files changed, 52 insertions(+), 7 deletions(-) > > [...] > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index 7762653..2a6f6c9 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -865,6 +865,7 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > FSFpePtr conn = (FSFpePtr) fpe->private; > fsQueryXInfoReply *rep; > char *buf; > + long bufleft; /* length of reply left to use */ Please initialize variables. Even if they are re-set later on. long bufleft = 0; > fsPropInfo *pi; > fsPropOffset *po; > pointer pd; > @@ -895,7 +896,10 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > > buf = (char *) rep; > buf += SIZEOF(fsQueryXInfoReply); > - > + > + bufleft = rep->length << 2; > + bufleft -= SIZEOF(fsQueryXInfoReply); > + > /* move the data over */ > fsUnpack_XFontInfoHeader(rep, pInfo); > > @@ -903,19 +907,51 @@ fs_read_query_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > _fs_init_fontinfo(conn, pInfo); > > /* Compute offsets into the reply */ > + if (bufleft < SIZEOF(fsPropInfo)) > + { > + ret = -1; > +#ifdef DEBUG > + fprintf(stderr, "fsQueryXInfo: bufleft (%ld) < SIZEOF(fsPropInfo)\n", > + bufleft); > +#endif > + goto bail; > + } > pi = (fsPropInfo *) buf; > buf += SIZEOF (fsPropInfo); > + bufleft -= pi->num_offsets * SIZEOF(fsPropOffset); This looks wrong. You probably meant to use: bufleft -= SIZEOF (fsPropInfo); > + if (bufleft < pi->data_len) This looks wrong, too. Check: https://git.centos.org/blob/rpms!libXfont.git/cf1e18c13a5ba2054e36a6f0b044c… You probably meant to use: if ((bufleft / SIZEOF(fsPropOffset)) < pi->num_offsets) or if (bufleft < (SIZEOF(fsPropOffset) * pi->num_offsets)) and > + { > + ret = -1; > +#ifdef DEBUG > + fprintf(stderr, > + "fsQueryXInfo: bufleft (%ld) < data_len (%d)\n", > + bufleft, pi->data_len); here either: "fsQueryXInfo: (bufleft / SIZEOF(fsPropOffset)) (%ld) < pi->num_offsets (%d)\n", bufleft / SIZEOF(fsPropOffset), pi->num_offsets); or "fsQueryXInfo: bufleft (%ld) < (SIZEOF(fsPropOffset) * pi->num_offsets) (%d)\n", bufleft, SIZEOF(fsPropOffset) * pi->num_offsets); depending on what you used before. > +#endif > + goto bail; > + } > po = (fsPropOffset *) buf; > buf += pi->num_offsets * SIZEOF(fsPropOffset); > + bufleft -= pi->data_len; Same problem here. Should be: bufleft -= pi->num_offsets * SIZEOF(fsPropOffset); > + { This block will ALWAYS be executed and ALWAYS *FAIL*! You're missing (*before* the curly brace): if (bufleft < pi->data_len) > + ret = -1; > +#ifdef DEBUG > + fprintf(stderr, > + "fsQueryXInfo: bufleft (%ld) < data_len (%d)\n", > + bufleft, pi->data_len); > +#endif > + goto bail; > + } > pd = (pointer) buf; > buf += pi->data_len; > + bufleft -= pi->data_len; > > /* convert the properties and step over the reply */ > ret = _fs_convert_props(pi, po, pd, pInfo); > + bail: > _fs_done_read (conn, rep->length << 2); > - > + > if (ret == -1) > { > fs_cleanup_bfont (bfont); This looks OK again.

2 4

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 12/52: Move COPYING.full+lite as COPYING to /
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit 902dc519d96be582088e5fe0644cefac7ecc0133 > Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> > Date: Sat Feb 14 15:58:11 2015 +0100 > > Move COPYING.full+lite as COPYING to / > > Adapted packaging scripts: > > debian/roll-tarballs.sh > nx-libs.spec > --- > debian/COPYING.full+lite => COPYING | 0 > debian/roll-tarballs.sh | 1 - > nx-libs.spec | 11 +++++++---- > 3 files changed, 7 insertions(+), 5 deletions(-) > > diff --git a/debian/COPYING.full+lite b/COPYING > similarity index 100% > rename from debian/COPYING.full+lite > rename to COPYING > diff --git a/debian/roll-tarballs.sh b/debian/roll-tarballs.sh > index fcb8367..c7cac5f 100755 > --- a/debian/roll-tarballs.sh > +++ b/debian/roll-tarballs.sh > @@ -96,7 +96,6 @@ else > echo ${file##*/} >> doc/applied-patches/series > done > fi > -cp -v debian/COPYING.full+lite COPYING > > # apply all patches shipped in debian/patches and create a copy of them that we ship with the tarball > if [ -s "doc/applied-patches/series" ]; then > diff --git a/nx-libs.spec b/nx-libs.spec > index 5c1064f..f4084d9 100644 > --- a/nx-libs.spec > +++ b/nx-libs.spec > @@ -768,7 +768,8 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files > %defattr(-,root,root) > -%doc nx-X11/{COPYING,LICENSE,README} > +%doc COPYING > +%doc nx-X11/README Have you removed LICENSE by accident or was that intended? > %dir %{_libdir}/nx > %dir %{_libdir}/nx/X11 > %dir %{_datadir}/nx > @@ -913,7 +914,8 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files -n libXcomp3 > %defattr(-,root,root) > -%doc nxcomp/{COPYING,LICENSE,README} > +%doc COPYING > +%doc nxcomp/README Same here. > %_libdir/libXcomp.so.3* > > %files -n libXcompext-devel > @@ -924,7 +926,8 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files -n libXcompext3 > %defattr(-,root,root) > -%doc nxcompext/{COPYING,LICENSE,README} > +%doc COPYING > +%doc nxcompext/README Same here. > %_libdir/libXcompext.so.3* > > %files -n libXcompshad-devel > @@ -944,7 +947,7 @@ ln -s -f ../../../../%{_lib}/libXext.so.6 %{buildroot}%{_libdir}/nx/X11/Xinerama > > %files -n libXcompshad3 > %defattr(-,root,root) > -%doc nxcompshad/{COPYING,LICENSE} > +%doc COPYING Same here.

3 4

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 32/52: dix: integer overflow in GetHosts() [CVE-2014-8092 2/4]
by Mihai Moldovan 16 Feb '15

16 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit d4c76981f7fddb364166464c571ed8d3de3086cd > Author: Alan Coopersmith <alan.coopersmith(a)oracle.com> > Date: Mon Jan 6 23:30:14 2014 -0800 > > dix: integer overflow in GetHosts() [CVE-2014-8092 2/4] > > GetHosts() iterates over all the hosts it has in memory, and copies > them to a buffer. The buffer length is calculated by iterating over > all the hosts and adding up all of their combined length. There is a > potential integer overflow, if there are lots and lots of hosts (with > a combined length of > ~4 gig). This should be possible by repeatedly > calling ProcChangeHosts() on 64bit machines with enough memory. > > This patch caps the list at 1mb, because multi-megabyte hostname > lists for X access control are insane. > > v2: backport to nx-libs 3.6.x (Mike DePaulo) > Reported-by: Ilja Van Sprundel <ivansprundel(a)ioactive.com> > Signed-off-by: Alan Coopersmith <alan.coopersmith(a)oracle.com> > Reviewed-by: Peter Hutterer <peter.hutterer(a)who-t.net> > > Conflicts: > os/access.c > --- > nx-X11/programs/Xserver/os/access.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/nx-X11/programs/Xserver/os/access.c b/nx-X11/programs/Xserver/os/access.c > index b6a70a7..0e9d138 100644 > --- a/nx-X11/programs/Xserver/os/access.c > +++ b/nx-X11/programs/Xserver/os/access.c > @@ -1719,6 +1719,10 @@ GetHosts ( > { > nHosts++; > n += (((host->len + 3) >> 2) << 2) + sizeof(xHostEntry); > + /* Could check for INT_MAX, but in reality having more than 1mb of > + hostnames in the access list is ridiculous */ > + if (n >= 1048576) Not an error: I'd change the number "1048576" to "1024*1024", because "1048576" is not easily recognized as 1 MB while the latter is more clear (and the compiler statically optimizes it at compile/preprocessing time anyway.) if (n >= 1024*1024) Everything else looks fine.

1 1

Where can I download the NXagent source code?
by Chernousov Anton 16 Feb '15

16 Feb '15

Hi! I trying to compile from source x2goserver and can't find GIT repository for nxagent. Please tell me where it is. :) Thank you for your assistance. ================ *Chernousov Anton.* E-mail: anton(a)th22.ru Skype: anton10146 Web: http://th22.ru

2 1

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 01/01: Fix FTBFS due to the nxproxy executable already existing under /usr/lib/nx/bin/nx
by Mike Gabriel 16 Feb '15

16 Feb '15

HI Michael, On Sa 14 Feb 2015 23:07:49 CET, git-admin wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.5.0.x > in repository nx-libs. > > commit 7b0c8a2acdb866f23c0569b4ba549e9e8c94428e > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sat Feb 14 17:07:21 2015 -0500 > > Fix FTBFS due to the nxproxy executable already existing under > /usr/lib/nx/bin/nx > --- > debian/Makefile.nx-libs | 2 -- > debian/changelog | 2 ++ > 2 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/debian/Makefile.nx-libs b/debian/Makefile.nx-libs > index 3aeda73..52326fb 100644 > --- a/debian/Makefile.nx-libs > +++ b/debian/Makefile.nx-libs > @@ -62,8 +62,6 @@ install-lite: > $(INSTALL_DIR) $(DESTDIR)$(BINDIR) > for d in nxcomp nxproxy; do \ > $(MAKE) -C $$d install; done > - mkdir -p $(DESTDIR)$(NXLIBDIR)/bin/ > - mv $(DESTDIR)$(BINDIR)/nxproxy $(DESTDIR)$(NXLIBDIR)/bin/ > for f in nxproxy; do \ > $(INSTALL_PROGRAM) bin/$$f $(DESTDIR)$(BINDIR); done > For the record: o this fixes builds for all jobs on jenkins.x2go.org o it fixes the .deb packages o it breaks the .rpm packages (the ELF executable is missing in /usr/lib/nx/bin/nxproxy, whereas /usr/bin/nxproxy is only the wrapper script). /me is taking a deeper look at the different behaviours of debian/rules and nx-libs.spec at build time. Mike -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel(a)das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.x…

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] branch 3.6.x updated (1fd8551 -> 1ea1cd8)
by Mihai Moldovan 16 Feb '15

16 Feb '15

Everything not mentioned looks either fine or rather passes basic sanity and plausibility checks.

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 44/52: glx: Be more strict about rejecting invalid image sizes [CVE-2014-8093 2/6]
by Mihai Moldovan 15 Feb '15

15 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit cdf0c3e65670c797a4fd0617d44d2bdff4011815 > Author: Adam Jackson <ajax(a)redhat.com> > Date: Mon Nov 10 12:13:37 2014 -0500 > > glx: Be more strict about rejecting invalid image sizes [CVE-2014-8093 2/6] > > Before this we'd just clamp the image size to 0, which was just > hideously stupid; if the parameters were such that they'd overflow an > integer, you'd allocate a small buffer, then pass huge values into (say) > ReadPixels, and now you're scribbling over arbitrary server memory. > > v2: backport to nx-libs 3.6.x (Mike DePaulo) > > Reviewed-by: Keith Packard <keithp(a)keithp.com> > Reviewed-by: Julien Cristau <jcristau(a)debian.org> > Reviewed-by: Michal Srb <msrb(a)suse.com> > Reviewed-by: Andy Ritger <aritger(a)nvidia.com> > Signed-off-by: Adam Jackson <ajax(a)redhat.com> > Signed-off-by: Alan Coopersmith <alan.coopersmith(a)oracle.com> > Signed-off-by: Fedora X Ninjas <x(a)fedoraproject.org> > Signed-off-by: Dave Airlie <airlied(a)redhat.com> > --- > nx-X11/programs/Xserver/GL/glx/singlepix.c | 14 +++++++------- > nx-X11/programs/Xserver/GL/glx/singlepixswap.c | 14 +++++++------- > 2 files changed, 14 insertions(+), 14 deletions(-) > > diff --git a/nx-X11/programs/Xserver/GL/glx/singlepix.c b/nx-X11/programs/Xserver/GL/glx/singlepix.c > index 845c46a..be804d8 100644 > --- a/nx-X11/programs/Xserver/GL/glx/singlepix.c > +++ b/nx-X11/programs/Xserver/GL/glx/singlepix.c > @@ -70,7 +70,7 @@ int __glXDisp_ReadPixels(__GLXclientState *cl, GLbyte *pc) > swapBytes = *(GLboolean *)(pc + 24); > lsbFirst = *(GLboolean *)(pc + 25); > compsize = __glReadPixels_size(format,type,width,height); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > glPixelStorei(GL_PACK_LSB_FIRST, lsbFirst); > @@ -130,7 +130,7 @@ int __glXDisp_GetTexImage(__GLXclientState *cl, GLbyte *pc) > * are illegal, but then width, height, and depth would still be zero anyway. > */ > compsize = __glGetTexImage_size(target,level,format,type,width,height,depth); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > @@ -227,7 +227,7 @@ int __glXDisp_GetSeparableFilter(__GLXclientState *cl, GLbyte *pc) > compsize = __glGetTexImage_size(target,1,format,type,width,1,1); > compsize2 = __glGetTexImage_size(target,1,format,type,height,1,1); > > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > if (compsize2 < 0) compsize2 = 0; NO ACTION NEEDED: This is bad, bad, bad. compsize is checked, but compsize2 completely ignored. However, a later patch fixes this, so we are good. > compsize = __GLX_PAD(compsize); > compsize2 = __GLX_PAD(compsize2); > @@ -291,7 +291,7 @@ int __glXDisp_GetConvolutionFilter(__GLXclientState *cl, GLbyte *pc) > * are illegal, but then width and height would still be zero anyway. > */ > compsize = __glGetTexImage_size(target,1,format,type,width,height,1); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > @@ -346,7 +346,7 @@ int __glXDisp_GetHistogram(__GLXclientState *cl, GLbyte *pc) > * are illegal, but then width would still be zero anyway. > */ > compsize = __glGetTexImage_size(target,1,format,type,width,1,1); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > @@ -389,7 +389,7 @@ int __glXDisp_GetMinmax(__GLXclientState *cl, GLbyte *pc) > reset = *(GLboolean *)(pc + 13); > > compsize = __glGetTexImage_size(target,1,format,type,2,1,1); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > @@ -436,7 +436,7 @@ int __glXDisp_GetColorTable(__GLXclientState *cl, GLbyte *pc) > * are illegal, but then width would still be zero anyway. > */ > compsize = __glGetTexImage_size(target,1,format,type,width,1,1); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > diff --git a/nx-X11/programs/Xserver/GL/glx/singlepixswap.c b/nx-X11/programs/Xserver/GL/glx/singlepixswap.c > index ff68ece..cdc6f16 100644 > --- a/nx-X11/programs/Xserver/GL/glx/singlepixswap.c > +++ b/nx-X11/programs/Xserver/GL/glx/singlepixswap.c > @@ -79,7 +79,7 @@ int __glXDispSwap_ReadPixels(__GLXclientState *cl, GLbyte *pc) > swapBytes = *(GLboolean *)(pc + 24); > lsbFirst = *(GLboolean *)(pc + 25); > compsize = __glReadPixels_size(format,type,width,height); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes); > glPixelStorei(GL_PACK_LSB_FIRST, lsbFirst); > @@ -148,7 +148,7 @@ int __glXDispSwap_GetTexImage(__GLXclientState *cl, GLbyte *pc) > * are illegal, but then width, height, and depth would still be zero anyway. > */ > compsize = __glGetTexImage_size(target,level,format,type,width,height,depth); > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > > glPixelStorei(GL_PACK_SWAP_BYTES, !swapBytes); > __GLX_GET_ANSWER_BUFFER(answer,cl,compsize,1); > @@ -257,7 +257,7 @@ int __glXDispSwap_GetSeparableFilter(__GLXclientState *cl, GLbyte *pc) > compsize = __glGetTexImage_size(target,1,format,type,width,1,1); > compsize2 = __glGetTexImage_size(target,1,format,type,height,1,1); > > - if (compsize < 0) compsize = 0; > + if (compsize < 0) return BadLength; > if (compsize2 < 0) compsize2 = 0; NO ACTION NEEDED: Same problem here. Everything else in this patch looks fine.

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 29/52: CVE-2014-0210: unvalidated length fields in fs_read_list_info() from xorg/lib/libXfont commit d338f81df1e188eb16e1d6aeea7f4800f89c1218
by Mihai Moldovan 15 Feb '15

15 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit b65259bf3bcca15b5069cb7a6c06f95a40f79813 > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 22:38:32 2015 -0500 > > CVE-2014-0210: unvalidated length fields in fs_read_list_info() from xorg/lib/libXfont commit d338f81df1e188eb16e1d6aeea7f4800f89c1218 > > fs_read_list_info() parses a reply from the font server. The reply > contains a number of additional data items with embedded length or > count fields, none of which are validated. This can cause out of > bound reads when looping over these items in the reply. > --- > nx-X11/lib/font/fc/fserve.c | 56 ++++++++++++++++++++++++++++++++++++++++++- > 1 file changed, 55 insertions(+), 1 deletion(-) > > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index 60d9017..6ba3ad4 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -2500,6 +2500,7 @@ fs_read_list_info(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > FSBlockedListInfoPtr binfo = (FSBlockedListInfoPtr) blockrec->data; > fsListFontsWithXInfoReply *rep; > char *buf; > + long bufleft; Same here. Everything else in this patch looks OK.

1 0

Re: [X2Go-Dev] [X2Go-Commits] [nx-libs] 27/52: CVE-2014-0210: unvalidated length fields in fs_read_glyphs() from xorg/lib/libXfont commit 520683652564c2a4e42328ae23eef9bb63271565
by Mihai Moldovan 15 Feb '15

15 Feb '15

On 14.02.2015 05:47 PM, git-admin(a)x2go.org wrote: > This is an automated email from the git hooks/post-receive script. > > x2go pushed a commit to branch 3.6.x > in repository nx-libs. > > commit ece51493f1d970f45e53588e33a700464a42fbab > Author: Mike DePaulo <mikedep333(a)gmail.com> > Date: Sun Feb 8 22:27:47 2015 -0500 > > CVE-2014-0210: unvalidated length fields in fs_read_glyphs() from xorg/lib/libXfont commit 520683652564c2a4e42328ae23eef9bb63271565 > > fs_read_glyphs() parses a reply from the font server. The reply > contains embedded length fields, none of which are validated. > This can cause out of bound reads when looping over the glyph > bitmaps in the reply. > --- > nx-X11/lib/font/fc/fserve.c | 29 ++++++++++++++++++++++++++++- > 1 file changed, 28 insertions(+), 1 deletion(-) > > diff --git a/nx-X11/lib/font/fc/fserve.c b/nx-X11/lib/font/fc/fserve.c > index 79de4f3..26218e5 100644 > --- a/nx-X11/lib/font/fc/fserve.c > +++ b/nx-X11/lib/font/fc/fserve.c > @@ -1916,6 +1916,7 @@ fs_read_glyphs(FontPathElementPtr fpe, FSBlockDataPtr blockrec) > FontInfoPtr pfi = &pfont->info; > fsQueryXBitmaps16Reply *rep; > char *buf; > + long bufleft; /* length of reply left to use */ I'd also initialize this: long bufleft = 0; Everything else here is OK.

1 0

Re: [X2Go-Dev] Fixes for 2011-2014 X.org CVEs and potential regressions in nx-libs
by Michael DePaulo 15 Feb '15

15 Feb '15

2015-02-15 8:31 GMT-05:00 Mike DePaulo <mikedep333(a)gmail.com>: > bQBuWYZZrHSq5sOQcsDIQWu+r/7qcjvr+dyRT+OpvosVpZFpWXshb9a7gEBqB85/ Sorry, please ignore that email. I told ThunderBird with the EnigMail extension to send the email about CVEs being mitigated by "-nolisten TCP" twice because the 1st time produced an error message. For whatever reason, the 1st time it was sent, but it was sent encrypted. The 2nd time, it was sent successfully, and was signed.

1 0

← Newer
1
...
13
14
15
16
17
18
19
20
21
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev February 2015