CVE-2015-0255

Updated x11-server packages fix security vulnerability:

Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request, where the server trusts the client to send valid string lengths. A malicious client with string lengths exceeding the request length can cause the server to copy adjacent memory data into the XKB structs. This data is then available to the client via the XkbGetGeometry request. This can lead to information disclosure issues, as well as possibly a denial of service if a similar request can cause the server to crash (CVE-2015-0255).

These are all security issues fixed in the libXvnc-devel-1.7.0-2.1 package on the GA media of openSUSE Tumbleweed.

xorg-x11-server was updated to fix one security issue.

This security issue was fixed:

• CVE-2015-0255: Check string lenghts in XkbSetGeometry request (bnc#915810)

xorg-x11-server was updated to fix one security issue.

This security issue was fixed:

• CVE-2015-0255: Check string lenghts in XkbSetGeometry request (bnc#915810)

xorg-x11-server was updated to fix one security issue.

This security issue was fixed:

• CVE-2015-0255: Check string lenghts in XkbSetGeometry request (bnc#915810)

xorg-x11-server was updated to fix one security issue.

This security issue was fixed:

• CVE-2015-0255: Check string lenghts in XkbSetGeometry request (bnc#915810)

xorg-x11-server was updated to fix one security issue.

This security issue was fixed:

• CVE-2015-0255: Check string lenghts in XkbSetGeometry request (bnc#915810)

xorg-x11-server was updated to fix one security issue.

This security issue was fixed:

• CVE-2015-0255: Check string lenghts in XkbSetGeometry request (bnc#915810)

This collective update for xorg-x11-server provides the following fixes:

* Fix a segmentation fault that can occur when X11 packets are
  forwarded between a client and a server with different endianess.
  (bnc#874903)
* Free software cursor backing pixmap when transition between screens.
  This fixes a crash in multi screen support when an assert gets hit.
  (bnc#880835)
* Ignore numlock in Xvnc. Following keys from VNC client will be
  already modulated by numlock on client side. (bnc#878446)
* Fix crash when Xinerama gets disabled after RanR12 is initialized.
  (bnc#878433)
* Prevent crash at the end of 2nd server generation when number of
  privates differ between 1st and 2nd. (bnc#883598)
* Move Xinerama disable when only one screen is present to main loop.
  (bnc#883598)
* Improve Xinerama command line option handling. (bnc#883598)
* Work around a possible crash when object belongs to a client that no
  longer exists. (bnc#883516)
* Try to make keyboard bell ring on all devices attached to master
  keyboard. (bnc#879019)
* Implement DeleteInputDeviceRequest in Xvnc to avoid server crash when
  the Xserver restarts after a server reset. (bnc#880745).

tigervnc and fltk were updated to fix security issues and non-security bugs.

This security issue was fixed:

• CVE-2015-0255: Information leak in the XkbSetGeometry request of X servers (bnc#915810).

These non-security issues were fixed:

• vncviewer-tigervnc does not display mouse cursor shape changes (bnc#908738).
• vnc module for Xorg fails to load on startup, module mismatch (bnc#911577).
• An Xvnc session may become unusable when user logs out (bnc#920969)

fltk was updated to fix one non-security issue:

• vncviewer-tigervnc does not display mouse cursor shape changes (bnc#908738).

Additionally tigervnc was updated to 1.4.1, the contained X server was updated to to 1.15.2.

This collective update for xorg-x11-server provides the following fixes:

* Fix a segmentation fault that can occur when X11 packets are
  forwarded between a client and a server with different endianess.
  (bnc#874903)
* Free software cursor backing pixmap when transition between screens.
  This fixes a crash in multi screen support when an assert gets hit.
  (bnc#880835)
* Ignore numlock in Xvnc. Following keys from VNC client will be
  already modulated by numlock on client side. (bnc#878446)
* Fix crash when Xinerama gets disabled after RanR12 is initialized.
  (bnc#878433)
* Prevent crash at the end of 2nd server generation when number of
  privates differ between 1st and 2nd. (bnc#883598)
* Move Xinerama disable when only one screen is present to main loop.
  (bnc#883598)
* Improve Xinerama command line option handling. (bnc#883598)
* Work around a possible crash when object belongs to a client that no
  longer exists. (bnc#883516)
* Try to make keyboard bell ring on all devices attached to master
  keyboard. (bnc#879019)
* Implement DeleteInputDeviceRequest in Xvnc to avoid server crash when
  the Xserver restarts after a server reset. (bnc#880745).

X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (crash) via a crafted string length value in a XkbSetGeometry request.

Olivier Fourdan discovered that the X.Org X server incorrectly handled XkbSetGeometry requests resulting in an information leak. An attacker able to connect to an X server, either locally or remotely, could use this issue to possibly obtain sensitive information. (CVE-2015-0255)

It was discovered that the X.Org X server incorrectly handled certain trapezoids. An attacker able to connect to an X server, either locally or remotely, could use this issue to possibly crash the server. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-6424)

USN-2500-1 addressed CVE-2015-0255 for xorg-server. This update provides the corresponding fix for VNC4 on Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2015-0255)

USN-2726-1 addressed CVE-2015-1283 for Expat. This update provides the corresponding fix for VNC4 on Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2015-1283)

Original advisory details:

Olivier Fourdan discovered that the X.Org X server incorrectly handled XkbSetGeometry requests resulting in an information leak. An attacker able to connect to an X server, either locally or remotely, could use this issue to possibly obtain sensitive information. (CVE-2015-0255)

It was discovered that Expat incorrectly handled malformed XML data. If a user or application linked against Expat were tricked into opening a crafted XML file, an attacker could cause a denial of service, or possibly execute arbitrary code. (CVE-2015-1283)