ALSA-2021:1804

Source
https://errata.almalinux.org/8/ALSA-2021-1804.html
Import Source
https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2021:1804.json
JSON Data
https://api.osv.dev/v1/vulns/ALSA-2021:1804
Related
Published
2021-05-18T06:07:47Z
Modified
2021-11-12T10:20:56Z
Summary
Moderate: userspace graphics, xorg-x11, and mesa security, bug fix, and enhancement update
Details

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

Mesa provides a 3D graphics API that is compatible with Open Graphics Library (OpenGL). It also provides hardware-accelerated drivers for many popular graphics chips.

The following packages have been upgraded to a later upstream version: egl-wayland (1.1.5), libdrm (2.4.103), libglvnd (1.3.2), libinput (1.16.3), libwacom (1.6), mesa (20.3.3), xorg-x11-server (1.20.10). (BZ#1878160, BZ#1886648, BZ#1887654, BZ#1887655)

Security Fix(es):

  • xorg-x11-server: Out-of-bounds access in XkbSetNames function (CVE-2020-14345)

  • xorg-x11-server: Integer underflow in the X input extension protocol (CVE-2020-14346)

  • xorg-x11-server: Out-of-bounds access in XkbSetMap function (CVE-2020-14360)

  • xorg-x11-server: XkbSelectEvents integer underflow privilege escalation vulnerability (CVE-2020-14361)

  • xorg-x11-server: XRecordRegisterClients integer underflow privilege escalation vulnerability (CVE-2020-14362)

  • libX11: Integer overflow leads to double free in locale handling (CVE-2020-14363)

  • xorg-x11-server: XkbSetDeviceInfo heap-based buffer overflow privilege escalation vulnerability (CVE-2020-25712)

  • libX11: Heap overflow in the X input method client (CVE-2020-14344)

  • xorg-x11-server: Leak of uninitialized heap memory from the X server to clients in AllocatePixmap of dix/pixmap.c (CVE-2020-14347)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References

Affected packages

AlmaLinux:8 / libglvnd

Package

Name
libglvnd

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.2-1.el8

AlmaLinux:8 / libglvnd-core-devel

Package

Name
libglvnd-core-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.2-1.el8

AlmaLinux:8 / libglvnd-devel

Package

Name
libglvnd-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.2-1.el8

AlmaLinux:8 / libglvnd-egl

Package

Name
libglvnd-egl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.2-1.el8

AlmaLinux:8 / libglvnd-gles

Package

Name
libglvnd-gles

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.2-1.el8

AlmaLinux:8 / libglvnd-glx

Package

Name
libglvnd-glx

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.2-1.el8

AlmaLinux:8 / libglvnd-opengl

Package

Name
libglvnd-opengl

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:1.3.2-1.el8

AlmaLinux:8 / libinput-devel

Package

Name
libinput-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.16.3-1.el8

AlmaLinux:8 / libwacom-devel

Package

Name
libwacom-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.6-2.el8

AlmaLinux:8 / mesa-libOSMesa-devel

Package

Name
mesa-libOSMesa-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
20.3.3-2.el8

AlmaLinux:8 / mesa-libgbm-devel

Package

Name
mesa-libgbm-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
20.3.3-2.el8

AlmaLinux:8 / xorg-x11-drivers

Package

Name
xorg-x11-drivers

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.7-30.el8

AlmaLinux:8 / xorg-x11-server-devel

Package

Name
xorg-x11-server-devel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.20.10-1.el8

AlmaLinux:8 / xorg-x11-server-source

Package

Name
xorg-x11-server-source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.20.10-1.el8