xorg security update

2015-04-1012:06:39

CentOS Project

lists.centos.org

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:N/A:P

4.1 Medium

AI Score

Confidence

High

0.079 Low

EPSS

Percentile

94.3%

JSON

CentOS Errata and Security Advisory CESA-2015:0797

X.Org is an open source implementation of the X Window System. It provides
the basic low-level functionality that full-fledged graphical user
interfaces are designed upon.

A buffer over-read flaw was found in the way the X.Org server handled
XkbGetGeometry requests. A malicious, authorized client could use this flaw
to disclose portions of the X.Org server memory, or cause the X.Org server
to crash using a specially crafted XkbGetGeometry request. (CVE-2015-0255)

This issue was discovered by Olivier Fourdan of Red Hat.

All xorg-x11-server users are advised to upgrade to these updated packages,
which contain a backported patch to correct this issue.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2015-April/083221.html
https://lists.centos.org/pipermail/centos-announce/2015-April/083222.html

Affected packages:
xorg-x11-server-Xdmx
xorg-x11-server-Xephyr
xorg-x11-server-Xnest
xorg-x11-server-Xorg
xorg-x11-server-Xvfb
xorg-x11-server-common
xorg-x11-server-devel
xorg-x11-server-source

Upstream details at:
https://access.redhat.com/errata/RHSA-2015:0797

OSVersionArchitecturePackageVersionFilename
CentOS7x86_64xorg-x11-server-common< 1.15.0-33.el7_1xorg-x11-server-common-1.15.0-33.el7_1.x86_64.rpm
CentOS7i686xorg-x11-server-devel< 1.15.0-33.el7_1xorg-x11-server-devel-1.15.0-33.el7_1.i686.rpm
CentOS7x86_64xorg-x11-server-devel< 1.15.0-33.el7_1xorg-x11-server-devel-1.15.0-33.el7_1.x86_64.rpm
CentOS7noarchxorg-x11-server-source< 1.15.0-33.el7_1xorg-x11-server-source-1.15.0-33.el7_1.noarch.rpm
CentOS7x86_64xorg-x11-server-xdmx< 1.15.0-33.el7_1xorg-x11-server-Xdmx-1.15.0-33.el7_1.x86_64.rpm
CentOS7x86_64xorg-x11-server-xephyr< 1.15.0-33.el7_1xorg-x11-server-Xephyr-1.15.0-33.el7_1.x86_64.rpm
CentOS7x86_64xorg-x11-server-xnest< 1.15.0-33.el7_1xorg-x11-server-Xnest-1.15.0-33.el7_1.x86_64.rpm
CentOS7x86_64xorg-x11-server-xorg< 1.15.0-33.el7_1xorg-x11-server-Xorg-1.15.0-33.el7_1.x86_64.rpm
CentOS7x86_64xorg-x11-server-xvfb< 1.15.0-33.el7_1xorg-x11-server-Xvfb-1.15.0-33.el7_1.x86_64.rpm
CentOS6i686xorg-x11-server-common< 1.15.0-26.el6.centosxorg-x11-server-common-1.15.0-26.el6.centos.i686.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	7	x86_64	xorg-x11-server-common	< 1.15.0-33.el7_1	xorg-x11-server-common-1.15.0-33.el7_1.x86_64.rpm
CentOS	7	i686	xorg-x11-server-devel	< 1.15.0-33.el7_1	xorg-x11-server-devel-1.15.0-33.el7_1.i686.rpm
CentOS	7	x86_64	xorg-x11-server-devel	< 1.15.0-33.el7_1	xorg-x11-server-devel-1.15.0-33.el7_1.x86_64.rpm
CentOS	7	noarch	xorg-x11-server-source	< 1.15.0-33.el7_1	xorg-x11-server-source-1.15.0-33.el7_1.noarch.rpm
CentOS	7	x86_64	xorg-x11-server-xdmx	< 1.15.0-33.el7_1	xorg-x11-server-Xdmx-1.15.0-33.el7_1.x86_64.rpm
CentOS	7	x86_64	xorg-x11-server-xephyr	< 1.15.0-33.el7_1	xorg-x11-server-Xephyr-1.15.0-33.el7_1.x86_64.rpm
CentOS	7	x86_64	xorg-x11-server-xnest	< 1.15.0-33.el7_1	xorg-x11-server-Xnest-1.15.0-33.el7_1.x86_64.rpm
CentOS	7	x86_64	xorg-x11-server-xorg	< 1.15.0-33.el7_1	xorg-x11-server-Xorg-1.15.0-33.el7_1.x86_64.rpm
CentOS	7	x86_64	xorg-x11-server-xvfb	< 1.15.0-33.el7_1	xorg-x11-server-Xvfb-1.15.0-33.el7_1.x86_64.rpm
CentOS	6	i686	xorg-x11-server-common	< 1.15.0-26.el6.centos	xorg-x11-server-common-1.15.0-26.el6.centos.i686.rpm