CVE-2018-14599

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact.

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact.

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact.

• CVE-2018-14599: fix off-by-one writes in XListExtensions, XGetFontPath and XListFonts
• CVE-2018-14600: fix out-of-bounds write in XListExtensions and XGetFontPath
• CVE-2018-14598: fix crash on invalid reply in XListExtensions and XGetFontPath
• CVE-2021-31535: reject strings longer than USHRT_MAX before sending them on the wire
• CVE-2023-3138: add bounds checks for extension request, event and error codes
• CVE-2023-43787: fix integer overflow in XCreateImage leading to heap overflow

• CVE-2018-14599: fix off-by-one writes in XListExtensions, XGetFontPath and XListFonts
• CVE-2018-14600: fix out-of-bounds write in XListExtensions and XGetFontPath
• CVE-2018-14598: fix crash on invalid reply in XListExtensions and XGetFontPath
• CVE-2021-31535: reject strings longer than USHRT_MAX before sending them on the wire
• CVE-2023-3138: add bounds checks for extension request, event and error codes
• CVE-2023-43787: fix integer overflow in XCreateImage leading to heap overflow

Updated libx11 packages fix security vulnerabilities:

An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault) (CVE-2018-14598).

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c is vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact (CVE-2018-14599).

An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution (CVE-2018-14600).

These are all security issues fixed in the libX11-6-1.7.2-1.2 package on the GA media of openSUSE Tumbleweed.

This update for xorg-x11-libX11 fixes the following issues:

• CVE-2018-14599: The function XListExtensions was vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact (bsc#1102062)
• CVE-2018-14600: The function XListExtensions interpreted a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution (bsc#1102068)
• CVE-2018-14598: A malicious server could have sent a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault) (bsc#1102073)

This update for libX11 fixes the following security issues:

• CVE-2018-14599: The function XListExtensions was vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact (bsc#1102062)
• CVE-2018-14600: The function XListExtensions interpreted a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution (bsc#1102068)
• CVE-2018-14598: A malicious server could have sent a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault) (bsc#1102073)

This update for libX11 and libxcb fixes the following issue:

libX11:

These security issues were fixed:

• CVE-2018-14599: The function XListExtensions was vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact (bsc#1102062).
• CVE-2018-14600: The function XListExtensions interpreted a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution (bsc#1102068).
• CVE-2018-14598: A malicious server could have sent a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault) (bsc#1102073).

This non-security issue was fixed:

• Make use of the new 64-bit sequence number API in XCB 1.11.1 to avoid the 32-bit sequence number wrap in libX11 (bsc#1094327).

libxcb:

• Expose 64-bit sequence number from XCB API so that Xlib and others can use it even on 32-bit environment. (bsc#1094327)

Tobias Stoeckmann discovered that libx11 incorrectly handled certain images. An attacker could possibly use this issue to access sensitive information (CVE-2016-7942)

Tobias Stoeckmann discovered that libx11 incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information. (CVE-2016-7943)

It was discovered that libx11 incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2018-14598, CVE-2018-14599, CVE-2018-14600)