0709a8db85
xorg-server 1.20.9, couldn't find a tarball). X.Org security advisory: July 31, 2020 X Server Pixel Data Uninitialized Memory Information Disclosure =============================================================== CVE-2020-14347 Allocation for pixmap data in AllocatePixmap() does not initialize the memory in xserver, it leads to leak uninitialize heap memory to clients. When the X server runs with elevated privileges. This flaw can lead to ASLR bypass, which when combined with other flaws (known/unknown) could lead to lead to privilege elevation in the client. Patch ===== A patch for this issue has been commited to the xorg server git repository. xorg-server 1.20.9 will be released shortly and will include this patch. https://gitlab.freedesktop.org/xorg/xserver.git diff --git a/dix/pixmap.c b/dix/pixmap.c index 1186d7dbb..5a0146bbb 100644 --- a/dix/pixmap.c +++ b/dix/pixmap.c @@ -116,7 +116,7 @@ AllocatePixmap(ScreenPtr pScreen, int pixDataSize) if (pScreen->totalPixmapSize > ((size_t) - 1) - pixDataSize) return NullPixmap; - pPixmap = malloc(pScreen->totalPixmapSize + pixDataSize); + pPixmap = calloc(1, pScreen->totalPixmapSize + pixDataSize); if (!pPixmap) return NullPixmap; Thanks ====== This vulnerability was discovered by Jan-Niklas Sohn working with Trend Micro Zero Day Initiative.
21 lines
1.7 KiB
Text
21 lines
1.7 KiB
Text
$NetBSD: distinfo,v 1.102 2020/07/31 16:50:57 maya Exp $
|
|
|
|
SHA1 (xorg-server-1.20.8.tar.bz2) = 077d081f912faf11c87ea1c9d0e29490961b0cd4
|
|
RMD160 (xorg-server-1.20.8.tar.bz2) = 74f2a5ab7b482d2aded54fd412e9c0d673f270ba
|
|
SHA512 (xorg-server-1.20.8.tar.bz2) = ab0ec0fcbf490c61558b9297f61b58fd2dedb676c78bef6431dc9166054743b43a0091b88a8b3f4e81d1f539909440ee7e188a298cefabe13ea89159639cd805
|
|
Size (xorg-server-1.20.8.tar.bz2) = 6309640 bytes
|
|
SHA1 (patch-configure) = ce2c732c3d8493445744a927a25b9cd3b45880f8
|
|
SHA1 (patch-dix_pixmap.c) = 92c9343f71ddc418c0f61e8138e0b209cefcb221
|
|
SHA1 (patch-hw_xfree86_common_xf86AutoConfig.c) = 70adf85be9fc6222a335686e7e9e9f385aca02f9
|
|
SHA1 (patch-hw_xfree86_common_xf86sbusBus.h) = f56f87336b2f669413ebb1005a2b64568a111f92
|
|
SHA1 (patch-hw_xfree86_dri2_dri2.c) = 0bf58305059321e10f6f58186301dbb7cb858c2a
|
|
SHA1 (patch-hw_xfree86_os-support_bsd_arm__video.c) = 9c03b24f44eafc5fabe27e9d6cc6c54b607e47c3
|
|
SHA1 (patch-hw_xfree86_os-support_bsd_bsd__VTsw.c) = 90343f694c27a6fdd5070e1167687943bd056a99
|
|
SHA1 (patch-hw_xfree86_os-support_bsd_bsd__init.c) = b58ce2005251c1b3f723ee87c759f75bcb27e230
|
|
SHA1 (patch-hw_xfree86_os-support_bsd_i386__video.c) = f2c72562a40c0e3109991453aff9c2c082526b1b
|
|
SHA1 (patch-hw_xfree86_os-support_bus_Sbus.c) = 0035b970bdae1bab51b8ca6bfeed060ec4df3a60
|
|
SHA1 (patch-hw_xfree86_os-support_solaris_solaris-amd64.S) = 088a3118deb7567194e08dd46e34cb6edba38400
|
|
SHA1 (patch-hw_xfree86_os-support_xf86_OSproc.h) = e1c049857893d2f050d5fb297a3e8ef86f0b1d7e
|
|
SHA1 (patch-hw_xfree86_os_support_bus_xf86Sbus.h) = 0e0a243b737f8f762c9f8f24a2265d1b6aefb544
|
|
SHA1 (patch-hw_xwayland_xwayland-input.c) = b876642a56f4930dfaa88cff77d4518cfe9d73e0
|
|
SHA1 (patch-test_xtest.c) = 77622ef481e91e64b3a6dd64b8579404f33ec88f
|