CVE-2014-8091

Ilja van Sprundel of IOActive discovered several security issues in the X.org X server, which may lead to privilege escalation or denial of service (CVE-2014-8091, CVE-2014-8092, CVE-2014-8093, CVE-2014-8094, CVE-2014-8095, CVE-2014-8096, CVE-2014-8097, CVE-2014-8098, CVE-2014-8099, CVE-2014-8100, CVE-2014-8101, CVE-2014-8102).

This collective update for xorg-x11-server provides the following fixes:

* Fix a segmentation fault that can occur when X11 packets are
  forwarded between a client and a server with different endianess.
  (bnc#874903)
* Free software cursor backing pixmap when transition between screens.
  This fixes a crash in multi screen support when an assert gets hit.
  (bnc#880835)
* Ignore numlock in Xvnc. Following keys from VNC client will be
  already modulated by numlock on client side. (bnc#878446)
* Fix crash when Xinerama gets disabled after RanR12 is initialized.
  (bnc#878433)
* Prevent crash at the end of 2nd server generation when number of
  privates differ between 1st and 2nd. (bnc#883598)
* Move Xinerama disable when only one screen is present to main loop.
  (bnc#883598)
* Improve Xinerama command line option handling. (bnc#883598)
* Work around a possible crash when object belongs to a client that no
  longer exists. (bnc#883516)
* Try to make keyboard bell ring on all devices attached to master
  keyboard. (bnc#879019)
* Implement DeleteInputDeviceRequest in Xvnc to avoid server crash when
  the Xserver restarts after a server reset. (bnc#880745).

This collective update for xorg-x11-server provides the following fixes:

* Fix a segmentation fault that can occur when X11 packets are
  forwarded between a client and a server with different endianess.
  (bnc#874903)
* Free software cursor backing pixmap when transition between screens.
  This fixes a crash in multi screen support when an assert gets hit.
  (bnc#880835)
* Ignore numlock in Xvnc. Following keys from VNC client will be
  already modulated by numlock on client side. (bnc#878446)
* Fix crash when Xinerama gets disabled after RanR12 is initialized.
  (bnc#878433)
* Prevent crash at the end of 2nd server generation when number of
  privates differ between 1st and 2nd. (bnc#883598)
* Move Xinerama disable when only one screen is present to main loop.
  (bnc#883598)
* Improve Xinerama command line option handling. (bnc#883598)
* Work around a possible crash when object belongs to a client that no
  longer exists. (bnc#883516)
* Try to make keyboard bell ring on all devices attached to master
  keyboard. (bnc#879019)
* Implement DeleteInputDeviceRequest in Xvnc to avoid server crash when
  the Xserver restarts after a server reset. (bnc#880745).

X.Org X Window System (aka X11 and X) X11R5 and X.Org Server (aka xserver and xorg-server) before 1.16.3, when using SUN-DES-1 (Secure RPC) authentication credentials, does not check the return value of a malloc call, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a crafted connection request.

Ilja van Sprundel discovered a multitude of security issues in the X.Org X server. An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible privilege escalation.

It was discovered that the NVIDIA graphics drivers incorrectly handled GLX indirect rendering support. An attacker able to connect to an X server, either locally or remotely, could use these issues to cause the X server to crash or execute arbitrary code resulting in possible privilege escalation.