Scientific Linux Security Update : Core X11 clients on SL6.x i386/x86_64

This script is Copyright (C) 2013 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

It was found that the x11perfcomp utility included the current working
directory in its PATH environment variable. Running x11perfcomp in an
attacker- controlled directory would cause arbitrary code execution
with the privileges of the user running x11perfcomp. (CVE-2011-2504)

Also with this update, the xorg-x11-utils and xorg-x11-server-utils
packages have been upgraded to upstream version 7.5, and the
xorg-x11-apps package to upstream version 7.6, which provides a number
of bug fixes and enhancements over the previous versions.

*xorg ABI change With this update there is a change in the X.org ABI
for the video drivers. This change will require compatible drivers.
Anyone using the drivers shipped with SL should have no problems.
Anyone using drivers from an external source - such as nVidia, ATI, or
ELRepo should ensure a compatible driver is loaded. Please ensure you
are on the most recent compatible driver before updating the system.
--

See also :

http://www.nessus.org/u?90ddb711

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 6.9
(CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 65563 ()

Bugtraq ID:

CVE ID: CVE-2011-2504