X11 vulnerabilities?

GazL · 06-20-2008, 04:23 PM

http://www.linuxquestions.org/questi...lities-648930/

After seeing this post on lq security board, I've been keeping my eye on the security announcements page on slackware.com for the last week expecting patches for these to pop up on there, but so far no sign.

Does Slackware not need these? or am I just being too impatient? The only reason I ask is that Pat is usually quite quick with security patches, so it got me wondering whether they may not be applicable for some reason.

Jeebizz · 06-20-2008, 04:52 PM

This looks relatively recent. I have no doubt that Pat will most likely release an update for Slackware, but consider that he just got through another major release of Slackware. I wouldn't worry too much though since there already have been some changes again to -current and some security patches, so I am sure there will be patches for X11 because Pat has never missed or skipped any patches that have to do with security. Also, if you haven't, I would recommend subscribing to the Slackware Security Mailing list. Thats how I get all my patches. Whenever a new security patch is released, I get emailed with links to the patch for my version of Slackware.

Security patches are being released for versions all the way down to 8.0.

H_TeXMeX_H · 06-21-2008, 12:37 PM

Most of them will crash xorg upon receiving a 'specially crafted request', not a huge exploit, and it must be done by an expert.

The major problem I see for most people is the one highlighted in red:

Quote:

Successful exploitation of vulnerabilities #1, #3, and #4 may allow execution of arbitrary code with privileges of the X server (typically root).

shadowsnipes · 06-21-2008, 01:38 PM

Quote:

Originally Posted by http://secunia.com/advisories/30627/

The vulnerabilities are reported in X.org X11 version R7.3. Other versions may also be affected.

I saw this when it first came out, but I'm pretty sure Slack 12.1 has R7.1, so it may not even affect us.

titopoquito · 06-21-2008, 01:53 PM

Quote:

Originally Posted by shadowsnipes

I saw this when it first came out, but I'm pretty sure Slack 12.1 has R7.1, so it may not even affect us.

I don't think you're right here, AFAIK Release 7.3 means x.org server 1.4 which IS installed with Slackware 12.1. (source: http://www.x.org/wiki/Releases/7.3)

brianL · 06-21-2008, 02:50 PM

Yeah, 12.1 has 7.3. From ANNOUNCE.12_1:

Quote:

- X11 7.3.0+. This is the X.Org Foundation's modular X Window System.
There's been much activity in the X development world, and the
improvements here in terms of performance and hardware support
are too numerous to mention them all here.

shadowsnipes · 06-21-2008, 04:13 PM

Quote:

Originally Posted by titopoquito

I don't think you're right here, AFAIK Release 7.3 means x.org server 1.4 which IS installed with Slackware 12.1. (source: http://www.x.org/wiki/Releases/7.3)

Thanks for correcting me on this. The x11-skel-7.1-noarch-6 package name is what tripped me up. I should have actually checked the X version instead. Sorry everyone.

shadowsnipes · 07-01-2008, 09:36 PM

It looks like the patches are available now.