libX11-1.8.6 (Xorg Library)

[Douglas R. Reno]

New point version

Contains a fix for CVE-2023-3138:

X.Org Security Advisory: June 15, 2023

Buffer overflows in InitExt.c in libX11 prior to 1.8.6 [CVE-2023-3138]
======================================================================

The functions in src/InitExt.c in libX11 prior to 1.8.6 do not check
that the values provided for the Request, Event, or Error IDs are
within the bounds of the arrays that those functions write to, using
those IDs as array indexes.  Instead they trusted that they were called
with values provided by an Xserver that was adhering to the bounds
specified in the X11 protocol, as all X servers provided by X.Org do.

As the protocol only specifies a single byte for these values, an
out-of-bounds value provided by a malicious server (or a malicious
proxy-in-the-middle) can only overwrite other portions of the Display
structure and not write outside the bounds of the Display structure
itself.  Testing has found it is possible to at least cause the client
to crash with this memory corruption.

This is fixed in:
https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/304a654a0d57bf0f00d8998185f0360332cfa36c
which is included in the libX11 1.8.6 release issued today.

[Rahul Chandra]

SBU and disk space didn't change much (about 60 kb on average and about .6 SBU for libX11 alone, still 2.1 on the whole). The tar is the same size and it builds fine on a fresh system. Here is a patch

[Xi Ruoyao]

Replying to Rahul Chandra:

SBU and disk space didn't change much (about 60 kb on average and about .6 SBU for libX11 alone, still 2.1 on the whole). The tar is the same size and it builds fine on a fresh system. Here is a patch

Generally you can skip SBU & disk usage measurement unless there is some reason to expect they'll change significantly. During the full-book test before making a release, all SBU & disk usage will be remeasured.

[Bruce Dubbs]

Replying to Xi Ruoyao:

Generally you can skip SBU & disk usage measurement unless there is some reason to expect they'll change significantly. During the full-book test before making a release, all SBU & disk usage will be remeasured.

That's true for pages like xorg libs, kf5, etc, but for most packages, I update, or at least check SBU and disk space for every package update. For point releases, I sometimes omit changing the stats for the tests.

[Xi Ruoyao]

I've verified the change and pushed it into trunk at r11.3-752-g677cf19bdf.

The ticket is left open for a security advisory.

[pierre]

Advisory done at commit 7ba24f2 in the www repo.

[Bruce Dubbs]

Milestone renamed