[prev in list] [next in list] [prev in thread] [next in thread]
List: oss-security
Subject: [oss-security] CVE-2017-16611 libXfont Open files with O_NOFOLLOW
From: Matthieu Herrb <matthieu.herrb () laas ! fr>
Date: 2017-11-28 14:55:24
Message-ID: 20171128145524.GI6762 () timmy ! laas ! fr
[Download RAW message or body]
Hi,
X.Org has just release libXfont 1.5.4 and libXfont2 2.0.3 which
contain the following security fix:
Author: Michal Srb <msrb@suse.com>
AuthorDate: Thu Oct 26 09:48:13 2017 +0200
Commit: Matthieu Herrb <matthieu@herrb.eu>
CommitDate: Sat Nov 25 11:46:50 2017 +0100
Open files with O_NOFOLLOW. (CVE-2017-16611)
A non-privileged X client can instruct X server running under root
to open any file by creating own directory with "fonts.dir",
"fonts.alias" or any font file being a symbolic link to any other
file in the system. X server will then open it. This can be issue
with special files such as /dev/watchdog.
https://marc.info/?l=freedesktop-xorg-announce&m=151188049718337&w=2
https://marc.info/?l=freedesktop-xorg-announce&m=151188044218304&w=2
--
Matthieu Herrb
["signature.asc" (application/pgp-signature)]
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic