Summary
USN-7573-1 fixed several vulnerabilities in X.Org. This update provides
the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu
20.04 LTS.
Original advisory details:
Nils Emmerich discovered that the X.Org X Server incorrectly handled
certain memory operations. An attacker could use these issues to cause the
X Server to crash, leading to a denial of service, obtain sensitive
information, or possibly execute arbitrary code.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | xorg-server | 2:1.18.4-0ubuntu0.12+esm18 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | xorg-server-hwe-16.04 | 2:1.19.6-1ubuntu4.1~16.04.6+esm10 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | xorg-server | 2:1.19.6-1ubuntu4.15+esm13 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | xorg-server-hwe-18.04 | 2:1.20.8-2ubuntu2.2~18.04.11+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | xorg-server | 2:1.20.13-1ubuntu1~20.04.20+esm1 |
Vulnerabilities 5
-
High 7.8
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension
A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.
-
High 7.3
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension
A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
-
High 7.3
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension
A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.
-
Medium 6.1
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursors
A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.
-
Medium 5.5
Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore
A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.