NS-SA-2024-0059

简介

moderate: libX11/brotli security update

严重级别

moderate

主题

An update for libX11/brotli is now available for NewStart CGSL MAIN 6.02.
NewStart Security has rated this update as having a security impact of moderate. A Common Vunlnerability Scoring System(CVSS)base score, which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.

详细描述

libX11:
brotli:


Security Fix(es):
libX11: A missing validation flaw was found in libX11. This flaw allows an attacker to inject X11 protocol commands on X clients, and in some cases, also bypass, authenticate (via injection of control characters), or potentially execute arbitrary code with permissions of the application compiled with libX11. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.(CVE-2021-31535)
libX11: A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.(CVE-2023-3138)
libX11: bugfix
brotli: A buffer overflow flaw was found in the Brotli library where an attacker could control the input length of a "one-shot" decompression request to a script that can trigger a crash. This issue can happen when copying chunks of data larger than 2 GiB.(CVE-2020-8927)
brotli: bugfix


Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
http://security.gd-linux.com/how_to_apply_patch.html
Remember the build tag is 6.02.F2B12.

影响组件

• libX11
• brotli

影响产品

• CGSL MAIN 6.02

更新包

CVE

• CVE-2021-31535
• CVE-2023-3138
• CVE-2020-8927

参考

• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-31535
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-3138
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-8927