CVE-2013-6424

Bryan Quigley discovered an integer underflow in the Xorg X server which could lead to denial of service or the execution of arbitrary code (CVE-2013-6424).

These are all security issues fixed in the xorg-x11-server-7.6_1.18.4-2.1 package on the GA media of openSUSE Tumbleweed.

This collective update for xorg-x11-server provides the following fixes:

* Fix a segmentation fault that can occur when X11 packets are
  forwarded between a client and a server with different endianess.
  (bnc#874903)
* Free software cursor backing pixmap when transition between screens.
  This fixes a crash in multi screen support when an assert gets hit.
  (bnc#880835)
* Ignore numlock in Xvnc. Following keys from VNC client will be
  already modulated by numlock on client side. (bnc#878446)
* Fix crash when Xinerama gets disabled after RanR12 is initialized.
  (bnc#878433)
* Prevent crash at the end of 2nd server generation when number of
  privates differ between 1st and 2nd. (bnc#883598)
* Move Xinerama disable when only one screen is present to main loop.
  (bnc#883598)
* Improve Xinerama command line option handling. (bnc#883598)
* Work around a possible crash when object belongs to a client that no
  longer exists. (bnc#883516)
* Try to make keyboard bell ring on all devices attached to master
  keyboard. (bnc#879019)
* Implement DeleteInputDeviceRequest in Xvnc to avoid server crash when
  the Xserver restarts after a server reset. (bnc#880745).

This collective update for xorg-x11-server provides the following fixes:

* Fix a segmentation fault that can occur when X11 packets are
  forwarded between a client and a server with different endianess.
  (bnc#874903)
* Free software cursor backing pixmap when transition between screens.
  This fixes a crash in multi screen support when an assert gets hit.
  (bnc#880835)
* Ignore numlock in Xvnc. Following keys from VNC client will be
  already modulated by numlock on client side. (bnc#878446)
* Fix crash when Xinerama gets disabled after RanR12 is initialized.
  (bnc#878433)
* Prevent crash at the end of 2nd server generation when number of
  privates differ between 1st and 2nd. (bnc#883598)
* Move Xinerama disable when only one screen is present to main loop.
  (bnc#883598)
* Improve Xinerama command line option handling. (bnc#883598)
* Work around a possible crash when object belongs to a client that no
  longer exists. (bnc#883516)
* Try to make keyboard bell ring on all devices attached to master
  keyboard. (bnc#879019)
* Implement DeleteInputDeviceRequest in Xvnc to avoid server crash when
  the Xserver restarts after a server reset. (bnc#880745).

Integer underflow in the xTrapezoidValid macro in render/picture.h in X.Org allows context-dependent attackers to cause a denial of service (crash) via a negative bottom value.

Olivier Fourdan discovered that the X.Org X server incorrectly handled XkbSetGeometry requests resulting in an information leak. An attacker able to connect to an X server, either locally or remotely, could use this issue to possibly obtain sensitive information. (CVE-2015-0255)

It was discovered that the X.Org X server incorrectly handled certain trapezoids. An attacker able to connect to an X server, either locally or remotely, could use this issue to possibly crash the server. This issue only affected Ubuntu 12.04 LTS. (CVE-2013-6424)