Home / mailings [slackware-security] xorg-server (SSA:2023-088-02)
Posted on 30 March 2023
Slackware Security[slackware-security] xorg-server (SSA:2023-088-02)
New xorg-server packages are available for Slackware 15.0 and -current to
fix a security issue.
Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/xorg-server-1.20.14-i586-8_slack15.0.txz: Rebuilt.
[PATCH] composite: Fix use-after-free of the COW.
Fix use-after-free that can lead to local privileges elevation on systems
where the X server is running privileged and remote code execution for ssh
X forwarding sessions.
For more information, see:
https://lists.x.org/archives/xorg-announce/2023-March/003374.html
https://www.cve.org/CVERecord?id=CVE-2023-1393
(* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-i586-8_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-i586-8_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-i586-8_slack15.0.txz: Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-i586-7_slack15.0.txz: Rebuilt.
[PATCH] composite: Fix use-after-free of the COW.
Fix use-after-free that can lead to local privileges elevation on systems
where the X server is running privileged and remote code execution for ssh
X forwarding sessions.
For more information, see:
https://lists.x.org/archives/xorg-announce/2023-March/003374.html
https://www.cve.org/CVERecord?id=CVE-2023-1393
(* Security fix *)
+--------------------------+
Where to find the new packages:
+-----------------------------+
Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.
Updated packages for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-1.20.14-i586-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xephyr-1.20.14-i586-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xnest-1.20.14-i586-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xvfb-1.20.14-i586-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xwayland-21.1.4-i586-7_slack15.0.txz
Updated packages for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-1.20.14-x86_64-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xephyr-1.20.14-x86_64-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xnest-1.20.14-x86_64-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xvfb-1.20.14-x86_64-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xwayland-21.1.4-x86_64-7_slack15.0.txz
Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-21.1.8-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xephyr-21.1.8-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xnest-21.1.8-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xvfb-21.1.8-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xwayland-23.1.1-i586-1.txz
Updated packages for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-21.1.8-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xephyr-21.1.8-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xnest-21.1.8-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xvfb-21.1.8-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xwayland-23.1.1-x86_64-1.txz
MD5 signatures:
+-------------+
Slackware 15.0 packages:
6d6a0629c73c3562c6eddfded160d8b5 xorg-server-1.20.14-i586-8_slack15.0.txz
3318631ca262facba1c44661f2c52e50 xorg-server-xephyr-1.20.14-i586-8_slack15.0.txz
b0cd131a9616ca533dc0e0f7116f6040 xorg-server-xnest-1.20.14-i586-8_slack15.0.txz
9d88240e55079c1e775aeaf33d5b58b6 xorg-server-xvfb-1.20.14-i586-8_slack15.0.txz
c21182933e39e2529ff0c724259b6cf2 xorg-server-xwayland-21.1.4-i586-7_slack15.0.txz
Slackware x86_64 15.0 packages:
c87c5923b4f58c0f4a70f05fb7e1ef46 xorg-server-1.20.14-x86_64-8_slack15.0.txz
3f8be8a91d878cac51bea5607704f159 xorg-server-xephyr-1.20.14-x86_64-8_slack15.0.txz
19c0f2f489ce625782410ef122e47ad2 xorg-server-xnest-1.20.14-x86_64-8_slack15.0.txz
ae86d6c2ecbad37e552206d0ba89abc5 xorg-server-xvfb-1.20.14-x86_64-8_slack15.0.txz
2624310c22eced24c8528221f8748279 xorg-server-xwayland-21.1.4-x86_64-7_slack15.0.txz
Slackware -current packages:
09835a9ed69b0a6c3e652a3dd258133b x/xorg-server-21.1.8-i586-1.txz
bf4d090c96f78ff7722f363efd33cd03 x/xorg-server-xephyr-21.1.8-i586-1.txz
935ecf67a638a2db75623e965e23766e x/xorg-server-xnest-21.1.8-i586-1.txz
8371b8e10d60d7009d205d049df007c7 x/xorg-server-xvfb-21.1.8-i586-1.txz
71c580fc4e1cf5d364c3071ab421bd79 x/xorg-server-xwayland-23.1.1-i586-1.txz
Slackware x86_64 -current packages:
780cca076058e19c632da1cd57d1568d x/xorg-server-21.1.8-x86_64-1.txz
2c4d467c2deb0f77fedac8fa99d31b61 x/xorg-server-xephyr-21.1.8-x86_64-1.txz
00256961e9af4895fc08e0251038118a x/xorg-server-xnest-21.1.8-x86_64-1.txz
9375d57d667c627e6757e65a96685aff x/xorg-server-xvfb-21.1.8-x86_64-1.txz
5cfd4343450dc2c76fb39e7c54fcedd0 x/xorg-server-xwayland-23.1.1-x86_64-1.txz
Installation instructions:
+------------------------+
Upgrade the packages as root:
# upgradepkg xorg-server-*.txz
+-----+
Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com
