SUSE-SU-2018:3102-1

Dashboard / Vulnerabilities / SUSE-SU-2018:3102-1

SUSE-SU-2018:3102-1

Summary: Security update for libX11 and libxcb

Details: This update for libX11 and libxcb fixes the following issue: libX11: These security issues were fixed: - CVE-2018-14599: The function XListExtensions was vulnerable to an off-by-one error caused by malicious server responses, leading to DoS or possibly unspecified other impact (bsc#1102062). - CVE-2018-14600: The function XListExtensions interpreted a variable as signed instead of unsigned, resulting in an out-of-bounds write (of up to 128 bytes), leading to DoS or remote code execution (bsc#1102068). - CVE-2018-14598: A malicious server could have sent a reply in which the first string overflows, causing a variable to be set to NULL that will be freed later on, leading to DoS (segmentation fault) (bsc#1102073). This non-security issue was fixed: - Make use of the new 64-bit sequence number API in XCB 1.11.1 to avoid the 32-bit sequence number wrap in libX11 (bsc#1094327). libxcb: - Expose 64-bit sequence number from XCB API so that Xlib and others can use it even on 32-bit environment. (bsc#1094327)

References: https://www.suse.com/support/update/announcement/2018/suse-su-20183102-1/, https://bugzilla.suse.com/1094327, https://bugzilla.suse.com/1102062, https://bugzilla.suse.com/1102068, https://bugzilla.suse.com/1102073, https://www.suse.com/security/cve/CVE-2018-14598, https://www.suse.com/security/cve/CVE-2018-14599, https://www.suse.com/security/cve/CVE-2018-14600