Univention Bugzilla – Bug 56923
xorg-server: Multiple issues (5.0)
Last modified: 2023-12-20 17:04:34 CET
New Debian xorg-server 2:1.20.4-1+deb10u12 fixes: This update addresses the following issues: 2:1.20.4-1+deb10u11 (Mon, 11 Dec 2023 19:03:02 +0100) * Non-maintainer upload by the LTS Team. * CVE-2023-6377 Xi: allocate enough XkbActions for our buttons * CVE-2023-6478 xorg-server: Out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty 2:1.20.4-1+deb10u12 (Sun, 17 Dec 2023 13:03:02 +0100) * CVE-2023-6377 Sync "Xi: allocate enough XkbActions for our buttons" The original upstream patch applied for CVE-2023-6377 was incomplete and still allows OOM access. This update syncs the patch with the upstream applied patch.
--- mirror/ftp/pool/main/x/xorg-server/xorg-server_1.20.4-1+deb10u10.dsc +++ apt/ucs_5.0-0-errata5.0-6/source/xorg-server_1.20.4-1+deb10u12.dsc @@ -1,3 +1,21 @@ +2:1.20.4-1+deb10u12 [Sun, 17 Dec 2023 13:03:02 +0100] Thorsten Alteholz <debian@alteholz.de>: + + * Non-maintainer upload by the LTS Team. + * CVE-2023-6377 + Sync "Xi: allocate enough XkbActions for our buttons" + The original upstream patch applied for CVE-2023-6377 was incomplete and + still allows OOM access. + This update syncs the patch with the upstream applied patch. + +2:1.20.4-1+deb10u11 [Mon, 11 Dec 2023 19:03:02 +0100] Thorsten Alteholz <debian@alteholz.de>: + + * Non-maintainer upload by the LTS Team. + * CVE-2023-6377 + Xi: allocate enough XkbActions for our buttons + * CVE-2023-6478 + xorg-server: Out-of-bounds memory read in RRChangeOutputProperty + and RRChangeProviderProperty + 2:1.20.4-1+deb10u10 [Mon, 23 Oct 2023 19:03:02 +0200] Thorsten Alteholz <debian@alteholz.de>: * Non-maintainer upload by the LTS Team. <http://piuparts.knut.univention.de/5.0-6/#1157358652462266644>
OK: bug OK: yaml OK: announce_errata OK: patch OK: piuparts [5.0-6] 305631449b Bug #56923: xorg-server 2:1.20.4-1+deb10u12 doc/errata/staging/xorg-server.yaml | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) [5.0-6] 03a1b5541a Bug #56923: xorg-server 2:1.20.4-1+deb10u12 doc/errata/staging/xorg-server.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+)
<https://errata.software-univention.de/#/?erratum=5.0x904>