Information has been released regarding five vulnerabilities in the libX11 and libXpm libraries developed by the X.Org project. The issues have been fixed in libXpm version 3.5.17 and libX11 version 1.8.7. Three vulnerabilities have been identified in the libx11 library, which provides functions with client implementations of the X11 protocol:
- CVE-2023-43785 — buffer overflow in the libX11 code, manifesting when processing a response from the X server with a number of characters that doesn't match the previously sent request XkbGetMap. The vulnerability is caused by a bug in X11R6.1, which has existed since 1996. It can be exploited when an application using libx11 connects to a malicious X server or an intermediary proxy controlled by an attacker.
- CVE-2023-43786 — stack exhaustion due to infinite recursion in the PutSubImage() function in libX11, occurring when processing specially crafted data in XPM format. The vulnerability has existed since the release of X11R2 in February 1988.
- CVE-2023-43787 — integer overflow in the XCreateImage() function in libX11, leading to heap overflow due to incorrect size calculations that do not match the actual data size. The problematic XCreateImage() function is called from XpmReadFileToPixmap(), allowing the vulnerability to be exploited when processing a specially crafted file in XPM format. This vulnerability has also existed since X11R2 (1988).
Additionally, two vulnerabilities in the libXpm library (CVE-2023-43788 and CVE-2023-43789) have been disclosed, caused by the ability to read from areas outside the bounds of allocated memory. The issues occur when loading a comment from memory buffer and processing an XPM file with an incorrect color map. Both vulnerabilities date back to 1998 and were discovered through the use of memory error detection tools and fuzz testing with AddressSanitizer and libFuzzer.
X.org has historical security issues; for example, ten years ago, at the 30th Chaos Communication Congress (CCC), during a presentation by security researcher Ilja van Sprundel, half of the presentation was dedicated to problems in server X.Org, along with the other half being the security of X11 client libraries. In Ilya's report, which identified 30 vulnerabilities affecting various X11 client libraries and DRI components of Mesa in 2013, there were emotional statements like "GLX is a terrible demotivator! 80,000 lines of pure horror!" and "In the past couple of months, I've found 120 bugs in it, and I'm not done checking yet."
Source: opennet.ru
