Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in x11-server-xgl
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in x11-server-xgl
ID: MDVSA-2008:025
Distribution: Mandriva
Plattformen: Mandriva 2007.0, Mandriva 2007.1, Mandriva 2008.0
Datum: Do, 24. Januar 2008, 07:45
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5760
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5958
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429
Applikationen: x11-server-xgl

Originalnachricht

This is a multi-part message in MIME format...

------------=_1201157112-4794-8992


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2008:025
http://www.mandriva.com/security/
_______________________________________________________________________

Package : x11-server-xgl
Date : January 23, 2008
Affected: 2007.0, 2007.1, 2008.0
_______________________________________________________________________

Problem Description:

An input validation flaw was found in the X.org server's XFree86-Misc
extension that could allow a malicious authorized client to cause
a denial of service (crash), or potentially execute arbitrary code
with root privileges on the X.org server (CVE-2007-5760).

A flaw was found in the X.org server's XC-SECURITY extension that
could allow a local user to verify the existence of an arbitrary file,
even in directories that are not normally accessible to that user
(CVE-2007-5958).

A memory corruption flaw was found in the X.org server's XInput
extension that could allow a malicious authorized client to cause a
denial of service (crash) or potentially execute arbitrary code with
root privileges on the X.org server (CVE-2007-6427).

An information disclosure flaw was found in the X.org server's TOG-CUP
extension that could allow a malicious authorized client to cause
a denial of service (crash) or potentially view arbitrary memory
content within the X.org server's address space (CVE-2007-6428).

Two integer overflow flaws were found in the X.org server's EVI and
MIT-SHM modules that could allow a malicious authorized client to
cause a denial of service (crash) or potentially execute arbitrary
code with the privileges of the X.org server (CVE-2007-6429).

The updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5760
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5958
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2007.0:
dd641b0925b43a3c6db839717424f150
2007.0/i586/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.i586.rpm
3747f570ab5133bc33992aa6eb88119b
2007.0/SRPMS/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
8d451268a57d8994f0ce0cf04f830ccf
2007.0/x86_64/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.x86_64.rpm
3747f570ab5133bc33992aa6eb88119b
2007.0/SRPMS/x11-server-xgl-0.0.1-0.20060714.11.3mdv2007.0.src.rpm

Mandriva Linux 2007.1:
5984120f81b569ed1d5ce33a4b99811c
2007.1/i586/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.i586.rpm
d5ea53e985f860f4283a31871e92cb24
2007.1/SRPMS/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
844815151b636f617544c15327d79c23
2007.1/x86_64/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.x86_64.rpm
d5ea53e985f860f4283a31871e92cb24
2007.1/SRPMS/x11-server-xgl-0.0.1-0.20070105.4.3mdv2007.1.src.rpm

Mandriva Linux 2008.0:
ee6ed1d6886652fc18672979d22a32d7
2008.0/i586/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.i586.rpm
9eb1f98a29c53dcd3226b5ac5a8e28c7
2008.0/SRPMS/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.src.rpm

Mandriva Linux 2008.0/X86_64:
67d964ead0d0f93df039c4d06ebf1b8c
2008.0/x86_64/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.x86_64.rpm
9eb1f98a29c53dcd3226b5ac5a8e28c7
2008.0/SRPMS/x11-server-xgl-0.0.1-0.20070917.2.1mdv2008.0.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (GNU/Linux)

iD8DBQFHmAl6mqjQ0CJFipgRAngpAJ46CwvieuNFdn+cdGTfjxFOLgVW2gCghV9B
BcCpDxAjOd8uqLpJaujN7BI=
=PkXK
-----END PGP SIGNATURE-----


------------=_1201157112-4794-8992
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1201157112-4794-8992--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung