[ GLSA 200409-34 ] X.org, XFree86: Integer and stack overflows in libXpm

From: Thierry Carrez (koon_at_gentoo.org)
Date: 09/27/04

  • Next message: Dave Horsfall: "Re: [Full-Disclosure] JPEG Virus" 
    Date: Mon, 27 Sep 2004 11:44:23 +0200
To: gentoo-announce@gentoo.org

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 200409-34
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                                http://security.gentoo.org/
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

      Severity: Normal
         Title: X.org, XFree86: Integer and stack overflows in libXpm
          Date: September 27, 2004
          Bugs: #64152
            ID: 200409-34

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

    Synopsis
    ========

    libXpm, the X Pixmap library that is a part of the X Window System,
    contains multiple stack and integer overflows that may allow a
    carefully-crafted XPM file to crash applications linked against
    libXpm, potentially allowing the execution of arbitrary code.

    Background
    ==========

    XFree86 and X.org are both implementations of the X Window System.

    Affected packages
    =================

        -------------------------------------------------------------------
         Package / Vulnerable / Unaffected
        -------------------------------------------------------------------
      1 x11-base/xorg-x11 < 6.7.0-r2 *>= 6.7.0-r2
                                == 6.8.0 >= 6.8.0-r1
      2 x11-base/xfree < 4.3.0-r7 >= 4.3.0-r7
        -------------------------------------------------------------------
         # Package 2 [x11-base/xfree] only applies to ALPHA and x86 users.

         NOTE: Any packages listed without architecture tags apply to all
               architectures...
        -------------------------------------------------------------------
         NOTE: Usage of XFree86 is deprecated on the AMD64, HPPA, IA64,
               MIPS, PPC and SPARC architectures: XFree86 users on those
               architectures should switch to X.org rather than upgrading
               XFree86.
        -------------------------------------------------------------------
         2 affected packages
        -------------------------------------------------------------------

    Description
    ===========

    Chris Evans has discovered multiple integer and stack overflow
    vulnerabilities in the X Pixmap library, libXpm, which is a part of the
    X Window System. These overflows can be exploited by the execution of a
    malicious XPM file, which can crash applications that are dependent on
    libXpm.

    Impact
    ======

    A carefully-crafted XPM file could crash applications that are linked
    against libXpm, potentially allowing the execution of arbitrary code
    with the privileges of the user running the application.

    Workaround
    ==========

    There is no known workaround at this time.

    Resolution
    ==========

    All X.org users should upgrade to the latest version:

        # emerge sync

        # emerge -pv ">=x11-base/xorg-x11-6.7.0-r2"
        # emerge ">=x11-base/xorg-x11-6.7.0-r2"

    All XFree86 users should upgrade to the latest version:

        # emerge sync

        # emerge -pv ">=x11-base/xfree-4.3.0-r7"
        # emerge ">=x11-base/xfree-4.3.0-r7"

    Note: Usage of XFree86 is deprecated on the AMD64, HPPA, IA64, MIPS,
    PPC and SPARC architectures: XFree86 users on those architectures
    should switch to X.org rather than upgrading XFree86.

    References
    ==========

      [ 1 ] X.org Security Advisory
            http://freedesktop.org/pipermail/xorg/2004-September/003196.html
      [ 2 ] X11R6.8.1 Release Notes
            http://freedesktop.org/pipermail/xorg/2004-September/003172.html
      [ 3 ] CAN-2004-0687
            http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0687
      [ 4 ] CAN-2004-0688
            http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0688

    Availability
    ============

    This GLSA and any updates to it are available for viewing at
    the Gentoo Security Website:

      http://security.gentoo.org/glsa/glsa-200409-34.xml

    Concerns?
    =========

    Security is a primary focus of Gentoo Linux and ensuring the
    confidentiality and security of our users machines is of utmost
    importance to us. Any security concerns should be addressed to
    security@gentoo.org or alternatively, you may file a bug at
    http://bugs.gentoo.org.

    License
    =======

    Copyright 2004 Gentoo Foundation, Inc; referenced text
    belongs to its owner(s).

    The contents of this document are licensed under the
    Creative Commons - Attribution / Share Alike license.

    http://creativecommons.org/licenses/by-sa/1.0

  • Next message: Dave Horsfall: "Re: [Full-Disclosure] JPEG Virus"

    Relevant Pages