libx11, libxrender vulnerability

Related Vulnerabilities: CVE-2013-7439  

libx11 could be made to crash or run programs if it processed specially crafted data.

Abhishek Arya discovered that libX11 incorrectly handled memory in the MakeBigReq macro. A remote attacker could use this issue to cause applications to crash, resulting in a denial of service, or possibly execute arbitrary code.

13 April 2015

libx11, libxrender vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 14.10
  • Ubuntu 14.04 LTS
  • Ubuntu 12.04 LTS

Summary

libx11 could be made to crash or run programs if it processed specially crafted data.

Software Description

  • libxrender - X11 Rendering Extension client library
  • libx11 - X11 client-side library

Details

Abhishek Arya discovered that libX11 incorrectly handled memory in the MakeBigReq macro. A remote attacker could use this issue to cause applications to crash, resulting in a denial of service, or possibly execute arbitrary code.

In addition, following the macro fix in libx11, a number of other packages have also been rebuilt as security updates including libxrender, libxext, libxi, libxfixes, libxrandr, libsdl1.2, libxv, libxp, and xserver-xorg-video-vmware.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 14.10
libxrender1 - 1:0.9.8-1build0.14.10.1
Ubuntu 14.04 LTS
libxrender1 - 1:0.9.8-1build0.14.04.1
Ubuntu 12.04 LTS
libx11-dev - 2:1.4.99.1-0ubuntu2.3
libxrender1 - 1:0.9.6-2ubuntu0.2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to reboot your computer to make all the necessary changes.

References