Multiple integer overflows in X.org libGLX in Mesa 9.1.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XF86DRIOpenConnection and (2) XF86DRIGetClientDriverName functions.

The remote Solaris system is missing necessary patches to address security updates :

  - Integer overflow in X.org libXfixes 5.0 and earlier     allows X servers to trigger allocation of insufficient     memory and a buffer overflow via vectors related to the     XFixesGetCursorImage function. (CVE-2013-1983)

  - Multiple integer overflows in X.org libXrandr 1.4.0 and     earlier allow X servers to trigger allocation of     insufficient memory and a buffer overflow via vectors     related to the (1) XRRQueryOutputProperty and (2)     XRRQueryProviderProperty functions. (CVE-2013-1986)

  - Multiple integer overflows in X.org libXrender 0.9.7 and     earlier allow X servers to trigger allocation of     insufficient memory and a buffer overflow via vectors     related to the (1) XRenderQueryFilters, (2)     XRenderQueryFormats, and (3) XRenderQueryPictIndexValues     functions. (CVE-2013-1987)

  - Multiple integer overflows in X.org libXRes 1.0.6 and     earlier allow X servers to trigger allocation of     insufficient memory and a buffer overflow via vectors     related to the (1) XResQueryClients and (2)     XResQueryClientResources functions. (CVE-2013-1988)

  - Multiple integer overflows in X.org libXv 1.0.7 and     earlier allow X servers to trigger allocation of     insufficient memory and a buffer overflow via vectors     related to the (1) XvQueryPortAttributes, (2)     XvListImageFormats, and (3) XvCreateImage function.
    (CVE-2013-1989)

  - Multiple integer overflows in X.org libXvMC 1.0.7 and     earlier allow X servers to trigger allocation of     insufficient memory and a buffer overflow via vectors     related to the (1) XvMCListSurfaceTypes and (2)     XvMCListSubpictureTypes functions. (CVE-2013-1990)

  - Multiple integer overflows in X.org libdmx 1.1.2 and     earlier allow X servers to trigger allocation of     insufficient memory and a buffer overflow via vectors     related to the (1) DMXGetScreenAttributes, (2)     DMXGetWindowAttributes, and (3) DMXGetInputAttributes     functions. (CVE-2013-1992)

  - Multiple integer overflows in X.org libGLX in Mesa 9.1.1     and earlier allow X servers to trigger allocation of     insufficient memory and a buffer overflow via vectors     related to the (1) XF86DRIOpenConnection and (2)     XF86DRIGetClientDriverName functions. (CVE-2013-1993)

  - Buffer overflow in X.org libXvMC 1.0.7 and earlier     allows X servers to cause a denial of service (crash)     and possibly execute arbitrary code via crafted length     or index values to the XvMCGetDRInfo function.
    (CVE-2013-1999)

  - Multiple buffer overflows in X.org libXxf86dga 1.1.3 and     earlier allow X servers to cause a denial of service     (crash) and possibly execute arbitrary code via crafted     length or index values to the (1) XDGAQueryModes and (2)     XDGASetMode functions. (CVE-2013-2000)

  - Buffer overflow in X.org libXxf86vm 1.1.2 and earlier     allows X servers to cause a denial of service (crash)     and possibly execute arbitrary code via crafted length     or index values to the XF86VidModeGetGammaRamp function.
    (CVE-2013-2001)

  - Integer overflow in X.org libXcursor 1.1.13 and earlier     allows X servers to trigger allocation of insufficient     memory and a buffer overflow via vectors related to the
    _XcursorFileHeaderCreate function. (CVE-2013-2003)

  - Integer overflow in X.org libXtst 1.2.1 and earlier     allows X servers to trigger allocation of insufficient     memory and a buffer overflow via vectors related to the     XRecordGetContext function. (CVE-2013-2063)

  - Integer overflow in X.org libxcb 1.9 and earlier allows     X servers to trigger allocation of insufficient memory     and a buffer overflow via vectors related to the     read_packet function. (CVE-2013-2064)

  - Buffer overflow in X.org libXv 1.0.7 and earlier allows     X servers to cause a denial of service (crash) and     possibly execute arbitrary code via crafted length or     index values to the XvQueryPortAttributes function.
    (CVE-2013-2066)

This Mesa update fixes the following security bug: CVE-2013-1993:
Integer overflows in XF86DRIOpenConnection and XF86DRIGetClientDriverName were fixed that could lead to client crashes when using a malicious X server.

This update fixes the following issue for Mesa on openSUSE 12.3 :

  - bnc#814947, fdo#62141: Make sure we do render between     two hiz flushes

The remote host is affected by the vulnerability described in GLSA-201405-07 (X.Org X Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in X.Org X Server. Please       review the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs (Mozilla Firefox does this), an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-1872)

It was found that Mesa did not correctly validate messages from the X server. A malicious X server could cause an application using Mesa to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-1993)

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0898 advisory.

    [6.5.1-7.11]
    - CVE-2013-1993 - buffer overflows in DRI protocol (#963066)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0897 advisory.

    - CVE-2013-1872: Updated patch with testing from upstream (#963063)
    - CVE-2013-1872: Updated patch from upstream (#963063)
    - CVE-2013-1872: Updated patch (#963063)
    - CVE-2013-1872: memory corruption oob read/write on intel (#963063)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of Mesa fixes multiple integer overflows.

Updated mesa packages fix multiple vulnerabilities

An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs (Mozilla Firefox does this), an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2013-1872).

It was found that Mesa did not correctly validate messages from the X server. A malicious X server could cause an application using Mesa to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2013-1993).

It was discovered that Mesa incorrectly handled certain memory calculations. An attacker could use this flaw to cause an application to crash, or possibly execute arbitrary code. (CVE-2013-1872)

Ilja van Sprundel discovered that Mesa incorrectly handled certain memory calculations. An attacker could use this flaw to cause an application to crash, or possibly execute arbitrary code.
(CVE-2013-1993).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

freedesktop.org reports :

Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues.

Most of these issues stem from the client libraries trusting the server to send correct protocol data, and not verifying that the values will not overflow or cause other damage. Most of the time X clients & servers are run by the same user, with the server more privileged from the clients, so this is not a problem, but there are scenarios in which a privileged client can be connected to an unprivileged server, for instance, connecting a setuid X client (such as a screen lock program) to a virtual X server (such as Xvfb or Xephyr) which the user has modified to return invalid data, potentially allowing the user to escalate their privileges.

The vulnerabilities include :

Integer overflows calculating memory needs for replies.

Sign extension issues calculating memory needs for replies.

Buffer overflows due to not validating length or offset values in replies.

Integer overflows parsing user-specified files.

Unbounded recursion parsing user-specified files.

Memory corruption due to unchecked return values.

An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs (Mozilla Firefox does this), an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-1872)

It was found that Mesa did not correctly validate messages from the X server. A malicious X server could cause an application using Mesa to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-1993)

All running applications linked against Mesa must be restarted for this update to take effect.

It was found that Mesa did not correctly validate messages from the X server. A malicious X server could cause an application using Mesa to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-1993)

All running applications linked against Mesa must be restarted for this update to take effect.

Updated mesa packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Mesa provides a 3D graphics API that is compatible with Open Graphics Library (OpenGL). It also provides hardware-accelerated drivers for many popular graphics chips.

It was found that Mesa did not correctly validate messages from the X server. A malicious X server could cause an application using Mesa to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-1993)

All users of Mesa are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running applications linked against Mesa must be restarted for this update to take effect.

Updated mesa packages that fix multiple security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Mesa provides a 3D graphics API that is compatible with Open Graphics Library (OpenGL). It also provides hardware-accelerated drivers for many popular graphics chips.

An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs (Mozilla Firefox does this), an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-1872)

It was found that Mesa did not correctly validate messages from the X server. A malicious X server could cause an application using Mesa to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2013-1993)

All users of Mesa are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running applications linked against Mesa must be restarted for this update to take effect.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:0898 advisory.

    Mesa provides a 3D graphics API that is compatible with Open Graphics     Library (OpenGL). It also provides hardware-accelerated drivers for many     popular graphics chips.

    It was found that Mesa did not correctly validate messages from the X     server. A malicious X server could cause an application using Mesa to crash     or, potentially, execute arbitrary code with the privileges of the user     running the application. (CVE-2013-1993)

    All users of Mesa are advised to upgrade to these updated packages, which     contain backported patches to correct these issues. All running     applications linked against Mesa must be restarted for this update to take     effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0897 advisory.

  - Mesa: Memory corruption (OOB read/write) on intel drivers (CVE-2013-1872)

  - Mesa: Multiple integer overflows leading to heap-based bufer overflows (CVE-2013-1993)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to privilege escalation or denial of service.

ID	Name	Product	Family	Severity
80819	Oracle Solaris Third-Party Patch Update : xorg (multiple_vulnerabilities_in_x_org)	Nessus	Solaris Local Security Checks	medium
74977	openSUSE Security Update : Mesa (openSUSE-2013-366)	Nessus	SuSE Local Security Checks	medium
74028	GLSA-201405-07 : X.Org X Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
69756	Amazon Linux AMI : mesa (ALAS-2013-198)	Nessus	Amazon Linux Local Security Checks	medium
68833	Oracle Linux 5 : mesa (ELSA-2013-0898)	Nessus	Oracle Linux Local Security Checks	critical
68832	Oracle Linux 6 : mesa (ELSA-2013-0897)	Nessus	Oracle Linux Local Security Checks	critical
67255	SuSE 10 Security Update : Mesa (ZYPP Patch Number 8604)	Nessus	SuSE Local Security Checks	medium
67105	SuSE 11.2 Security Update : Mesa (SAT Patch Number 7805)	Nessus	SuSE Local Security Checks	medium
67011	Mandriva Linux Security Advisory : mesa (MDVSA-2013:182)	Nessus	Mandriva Local Security Checks	medium
66961	Ubuntu 12.04 LTS / 12.10 / 13.04 : mesa, mesa-lts-quantal vulnerabilities (USN-1888-1)	Nessus	Ubuntu Local Security Checks	medium
66798	FreeBSD : xorg -- protocol handling issues in X Window System client libraries (2eebebff-cd3b-11e2-8f09-001b38c3836c)	Nessus	FreeBSD Local Security Checks	medium
66779	Scientific Linux Security Update : mesa on SL6.x i386/x86_64 (20130603)	Nessus	Scientific Linux Local Security Checks	medium
66778	Scientific Linux Security Update : mesa on SL5.x i386/x86_64 (20130603)	Nessus	Scientific Linux Local Security Checks	medium
66776	CentOS 5 : mesa (CESA-2013:0898)	Nessus	CentOS Local Security Checks	medium
66775	CentOS 6 : mesa (CESA-2013:0897)	Nessus	CentOS Local Security Checks	medium
66773	RHEL 5 : mesa (RHSA-2013:0898)	Nessus	Red Hat Local Security Checks	critical
66772	RHEL 6 : mesa (RHSA-2013:0897)	Nessus	Red Hat Local Security Checks	critical
66562	Debian DSA-2678-1 : mesa - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-1993

critical

Tenable Plugins

medium

medium

medium

medium

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

critical

medium