p PatchFirst

RLSA-2021:1804

RLSA-2021:1804 · Moderate: userspace graphics, xorg-x11, and mesa security, bug fix, and enhancement update

This page contains facts from public vulnerability sources. Check the original advisory before updating.

X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon. Mesa provides a 3D graphics API that is compatible with Open Graphics Library (OpenGL). It also provides hardware-accelerated drivers for many popular graphics chips. The following packages have been upgraded to a later upstream version: egl-wayland (1.1.5), libdrm (2.4.103), libglvnd (1.3.2), libinput (1.16.3), libwacom (1.6), mesa (20.3.3), xorg-x11-server (1.20.10). (BZ#1878160, BZ#1886648, BZ#1887654, BZ#1887655) Security Fix(es): * xorg-x11-server: Out-of-bounds access in XkbSetNames function (CVE-2020-14345) * xorg-x11-server: Integer underflow in the X input extension protocol (CVE-2020-14346) * xorg-x11-server: Out-of-bounds access in XkbSetMap function (CVE-2020-14360) * xorg-x11-server: XkbSelectEvents integer underflow privilege escalation vulnerability (CVE-2020-14361) * xorg-x11-server: XRecordRegisterClients integer underflow privilege escalation vulnerability (CVE-2020-14362) * libX11: Integer overflow leads to double free in locale handling (CVE-2020-14363) * xorg-x11-server: XkbSetDeviceInfo heap-based buffer overflow privilege escalation vulnerability (CVE-2020-25712) * libX11: Heap overflow in the X input method client (CVE-2020-14344) * xorg-x11-server: Leak of uninitialized heap memory from the X server to clients in AllocatePixmap of dix/pixmap.c (CVE-2020-14347) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

CVSS 7.8 · High · Fix available

Published
Updated

Stack: system

Affected products and versions

  • egl-wayland Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.1.5-3.el8

    Update to 0:1.1.5-3.el8

  • libdrm Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:2.4.103-1.el8

    Update to 0:2.4.103-1.el8

  • libglvnd Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 1:1.3.2-1.el8

    Update to 1:1.3.2-1.el8

  • libinput Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.16.3-1.el8

    Update to 0:1.16.3-1.el8

  • libwacom Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.6-2.el8

    Update to 0:1.6-2.el8

  • libx11 Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.6.8-4.el8

    Update to 0:1.6.8-4.el8

  • mesa Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:20.3.3-2.el8

    Update to 0:20.3.3-2.el8

  • xorg-x11-drivers Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:7.7-30.el8

    Update to 0:7.7-30.el8

  • xorg-x11-server Rocky Linux:8

    Affected ranges
    • ECOSYSTEM: < 0:1.20.10-1.el8

    Update to 0:1.20.10-1.el8

Original sources

Check your server →