[LUG.ro] Desbordamiento de búfer en XFree86 4.x (más vale tarde que...)

[Sebastián D. Criado]

--nextPart2301824.NQJxxzMnJX
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

El Jueves 22 Septiembre 2005 14:43, Horacio Castellini escribi=F3:
> Se ha descubierto una vulnerabilidad en XFree86 que potencialmente puede
> ser explotada por usuarios locales maliciosos para realizar escaladas de
> privilegios.
>
> Parece que los primeros en responder han sido: Red Hat y Gentoo. Como
> Debian se qued=F3 atr=E1s en esto...?
>
> la noticia en:
> "http://www.hispasec.com/unaaldia/2518"
>

=2D-------------------------------------------------------------------------
Debian Security Advisory DSA 816-1 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =
security@debian.org
http://www.debian.org/security/ =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0=
 =A0 =A0 =A0 Martin Schulze
September 19th, 2005 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0http://www.debi=
an.org/security/faq
=2D-------------------------------------------------------------------------

Package =A0 =A0 =A0 =A0: xfree86
Vulnerability =A0: integer overflow
Problem-Type =A0 : remote
Debian-specific: no
CVE ID =A0 =A0 =A0 =A0 : CAN-2005-2495
CERT advisory =A0: VU#102441

S=F8ren Sandmann discovered a bug in memory allocation for pixmap images,
that can cause a crash of the X server or to execute arbitrary code.

The update for the old stable distribution (woody) also contains a
different correction for multiple vulnerabilities in libXpm (DSA 607,
CAN-2004-0914, Bug#309143), since the old fix contained a regression.

=46or the old stable distribution (woody) this problem has been fixed in
version 4.1.0-16woody7.

=46or the stable distribution (sarge) this problem has been fixed in
version 4.3.0.dfsg.1-14sarge1.

=46or the unstable distribution (sid) this problem has been fixed in
version 6.8.2.dfsg.1-7 of X.Org.

We recommend that you upgrade your xfree86 and xorg packages.

=2D-=20

Sebasti=E1n D. Criado - scriado{en}ciudad.com.ar
** 5tas Jornadas Regionales de Software Libre - Rosario 2005 -=20
http://jornadas.ant.org.ar **
L.U.G.R.o - http://www.lugro.org.ar
GNU/Linux Registered User # 146768
=2D------------------------------------------------------------------
"Si el Universo fuera un programa estar=EDa hecho en C, y correr=EDa sobre
un sistema UNIX"
                                                   An=F3nimo.

		=09

--nextPart2301824.NQJxxzMnJX
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.0 (GNU/Linux)

iD8DBQBDMwND8hmHQ8ZCg0IRAhJ9AKC1dVcxP8BnwDFx1seh7qtXGSPylQCeJQD8
WLdkXgSifSJHOsJ5D502zQE=
=/BJF
-----END PGP SIGNATURE-----

--nextPart2301824.NQJxxzMnJX--