{"id":102614,"date":"2021-12-14T21:36:46","date_gmt":"2021-12-14T19:36:46","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-x-org-server"},"modified":"2021-12-14T21:36:46","modified_gmt":"2021-12-14T19:36:46","slug":"uyazvimosti-v-x-org-server","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-x-org-server","title":{"rendered":"Vulnerabilities in X.Org Server","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Four vulnerabilities have been identified in the X.Org Server that allow privilege escalation in the system when the X server runs with root privileges, or the execution of code on a remote system when access is granted via SSH using X11 session forwarding. These issues are expected to be addressed in the release of xorg-server 21.1.2, which is anticipated in the coming days. The problems remain unresolved in distributions (Debian, Ubuntu, RHEL, SUSE, Fedora, Arch). <\/p>\n
\n
CVE-2021-4008 \u2014 Buffer overflow in the SProcRenderCompositeGlyphs function, related to the incorrect length check of the data passed by the CompositeGlyphs request handler in the Render extension, which can be exploited to write arbitrary data beyond the buffer. A patch is available.\n
CVE-2021-4009 is a buffer overflow in the SProcXFixesCreatePointerBarrier function, caused by an improper length check of the request in the CreatePointerBarrier handler used in the XFixes extension. A fix patch is available.\n
CVE-2021-4010 \u2014 Buffer overflow in the SProcScreenSaverSuspend function, related to the incorrect length check of the Suspend request in the Screen Saver extension. A patch is available.\n
CVE-2021-4011 \u2014 Buffer overflow in the SwapCreateRegister function, related to the incorrect length check of the RecordCreateContext and RecordRegisterClients requests in the Record extension. A patch is available. <\/ul>\n