Important CentOS xorg-x11-server Security Update

Metadata

medium
6.5
xorg-x11-server-1.15.0-25.el6.centos.src.rpm, xorg-x11-server-1.15.0-7.el7_0.3.src.rpm, xorg-x11-server-Xdmx-1.15.0-25.el6.centos.i686.rpm, xorg-x11-server-Xdmx-1.15.0-25.el6.centos.x86_64.rpm, xorg-x11-server-Xdmx-1.15.0-7.el7_0.3.x86_64.rpm, xorg-x11-server-Xephyr-1.15.0-25.el6.centos.i686.rpm, xorg-x11-server-Xephyr-1.15.0-25.el6.centos.x86_64.rpm, xorg-x11-server-Xephyr-1.15.0-7.el7_0.3.x86_64.rpm, xorg-x11-server-Xnest-1.15.0-25.el6.centos.i686.rpm, xorg-x11-server-Xnest-1.15.0-25.el6.centos.x86_64.rpm, xorg-x11-server-Xnest-1.15.0-7.el7_0.3.x86_64.rpm, xorg-x11-server-Xorg-1.15.0-25.el6.centos.i686.rpm, xorg-x11-server-Xorg-1.15.0-25.el6.centos.x86_64.rpm, xorg-x11-server-Xorg-1.15.0-7.el7_0.3.x86_64.rpm, xorg-x11-server-Xvfb-1.15.0-25.el6.centos.i686.rpm, xorg-x11-server-Xvfb-1.15.0-25.el6.centos.x86_64.rpm, xorg-x11-server-Xvfb-1.15.0-7.el7_0.3.x86_64.rpm, xorg-x11-server-common-1.15.0-25.el6.centos.i686.rpm, xorg-x11-server-common-1.15.0-25.el6.centos.x86_64.rpm, xorg-x11-server-common-1.15.0-7.el7_0.3.x86_64.rpm, xorg-x11-server-devel-1.15.0-25.el6.centos.i686.rpm, xorg-x11-server-devel-1.15.0-25.el6.centos.x86_64.rpm, xorg-x11-server-devel-1.15.0-7.el7_0.3.i686.rpm, xorg-x11-server-devel-1.15.0-7.el7_0.3.x86_64.rpm, xorg-x11-server-source-1.15.0-25.el6.centos.noarch.rpm, xorg-x11-server-source-1.15.0-7.el7_0.3.noarch.rpm
CVE-2014-8091, CVE-2014-8092, CVE-2014-8093, CVE-2014-8094, CVE-2014-8095, CVE-2014-8096, CVE-2014-8097, CVE-2014-8098, CVE-2014-8099, CVE-2014-8100, CVE-2014-8101, CVE-2014-8102, CVE-2014-8103
rhn.redhat.com, lists.centos.org, lists.centos.org
2014-12-11
2017-07-27 19:08
ALAS-2015-470
Important CentOS xorg-x11-server Security Update
CVE-2014-8101 xorg-server
CVE-2014-8094 xorg-server
CVE-2014-8102 xorg-server
CVE-2014-8093 xorg-server
CVE-2014-8099 xorg-server
CVE-2014-8098 xorg-server
CVE-2014-8092 xorg-server
CVE-2014-8095 xorg-server
CVE-2014-8103 xorg-server
CVE-2014-8100 xorg-server
CVE-2014-8096 xorg-server
CVE-2014-8091 xorg-server
CVE-2014-8097 xorg-server
CVE-2014-8094
CVE-2014-8098
CVE-2014-8103
CVE-2014-8095
CVE-2014-8092
CVE-2014-8101
CVE-2014-8100
CVE-2014-8096
CVE-2014-8093
CVE-2014-8097
CVE-2014-8099
CVE-2014-8102
CVE-2014-8091
2017-04-01 19:08
2017-01-05 20:12

Description


Updated xorg-x11-server packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

X.Org is an open source implementation of the X Window System. It provides
the basic low-level functionality that full-fledged graphical user
interfaces are designed upon.

Multiple integer overflow flaws and out-of-bounds write flaws were found in
the way the X.Org server calculated memory requirements for certain X11
core protocol and GLX extension requests. A malicious, authenticated client
could use either of these flaws to crash the X.Org server or, potentially,
execute arbitrary code with root privileges. (CVE-2014-8092, CVE-2014-8093,
CVE-2014-8098)

It was found that the X.Org server did not properly handle SUN-DES-1
(Secure RPC) authentication credentials. A malicious, unauthenticated
client could use this flaw to crash the X.Org server by submitting a
specially crafted authentication request. (CVE-2014-8091)

Multiple out-of-bounds access flaws were found in the way the X.Org server
calculated memory requirements for certain requests. A malicious,
authenticated client could use either of these flaws to crash the X.Org
server, or leak memory contents to the client. (CVE-2014-8097)

An integer overflow flaw was found in the way the X.Org server calculated
memory requirements for certain DRI2 extension requests. A malicious,
authenticated client could use this flaw to crash the X.Org server.
(CVE-2014-8094)

Multiple out-of-bounds access flaws were found in the way the X.Org server
calculated memory requirements for certain requests. A malicious,
authenticated client could use either of these flaws to crash the X.Org
server. (CVE-2014-8095, CVE-2014-8096, CVE-2014-8099, CVE-2014-8100,
CVE-2014-8101, CVE-2014-8102, CVE-2014-8103)

All xorg-x11-server users are advised to upgrade to these updated packages,
which contain backported patches to correct these issues.
Please see https://www.redhat.com/footer/terms-of-use.html

Am I vulnerable?

The constraints below list the versions that this vulnerability is patched in, and versions that are unaffected. If a patch is ready but unrealeased, then it is pending.

Or, you can just let us figure it out for you! Appcanary continously monitor your installed packages, and tell you if any of them are vulnerable.

Sign up for monitoring

Affected package information

Release Package Patched in
6 xorg-x11-server xorg-x11-server-1.15.0-25.el6.centos.src.rpm
xorg-x11-server-common xorg-x11-server-common-1.15.0-25.el6.centos.i686.rpm
xorg-x11-server-common xorg-x11-server-common-1.15.0-25.el6.centos.x86_64.rpm
xorg-x11-server-devel xorg-x11-server-devel-1.15.0-25.el6.centos.x86_64.rpm
xorg-x11-server-devel xorg-x11-server-devel-1.15.0-25.el6.centos.i686.rpm
xorg-x11-server-source xorg-x11-server-source-1.15.0-25.el6.centos.noarch.rpm
xorg-x11-server-Xdmx xorg-x11-server-Xdmx-1.15.0-25.el6.centos.x86_64.rpm
xorg-x11-server-Xdmx xorg-x11-server-Xdmx-1.15.0-25.el6.centos.i686.rpm
xorg-x11-server-Xephyr xorg-x11-server-Xephyr-1.15.0-25.el6.centos.i686.rpm
xorg-x11-server-Xephyr xorg-x11-server-Xephyr-1.15.0-25.el6.centos.x86_64.rpm
xorg-x11-server-Xnest xorg-x11-server-Xnest-1.15.0-25.el6.centos.x86_64.rpm
xorg-x11-server-Xnest xorg-x11-server-Xnest-1.15.0-25.el6.centos.i686.rpm
xorg-x11-server-Xorg xorg-x11-server-Xorg-1.15.0-25.el6.centos.x86_64.rpm
xorg-x11-server-Xorg xorg-x11-server-Xorg-1.15.0-25.el6.centos.i686.rpm
xorg-x11-server-Xvfb xorg-x11-server-Xvfb-1.15.0-25.el6.centos.i686.rpm
xorg-x11-server-Xvfb xorg-x11-server-Xvfb-1.15.0-25.el6.centos.x86_64.rpm
7 xorg-x11-server xorg-x11-server-1.15.0-7.el7_0.3.src.rpm
xorg-x11-server-common xorg-x11-server-common-1.15.0-7.el7_0.3.x86_64.rpm
xorg-x11-server-devel xorg-x11-server-devel-1.15.0-7.el7_0.3.i686.rpm
xorg-x11-server-devel xorg-x11-server-devel-1.15.0-7.el7_0.3.x86_64.rpm
xorg-x11-server-source xorg-x11-server-source-1.15.0-7.el7_0.3.noarch.rpm
xorg-x11-server-Xdmx xorg-x11-server-Xdmx-1.15.0-7.el7_0.3.x86_64.rpm
xorg-x11-server-Xephyr xorg-x11-server-Xephyr-1.15.0-7.el7_0.3.x86_64.rpm
xorg-x11-server-Xnest xorg-x11-server-Xnest-1.15.0-7.el7_0.3.x86_64.rpm
xorg-x11-server-Xorg xorg-x11-server-Xorg-1.15.0-7.el7_0.3.x86_64.rpm
xorg-x11-server-Xvfb xorg-x11-server-Xvfb-1.15.0-7.el7_0.3.x86_64.rpm