Multiple integer overflows in X.org libchromeXvMC and libchromeXvMCPro in openChrome 0.3.2 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) uniDRIOpenConnection and (2) uniDRIGetClientDriverName functions.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple integer overflows in X.org libchromeXvMC and libchromeXvMCPro in openChrome 0.3.2 and earlier
    allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to
    the (1) uniDRIOpenConnection and (2) uniDRIGetClientDriverName functions. (CVE-2013-1994)

The remote host is affected by the vulnerability described in GLSA-201405-07 (X.Org X Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in X.Org X Server. Please       review the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

Ilja van Sprundel discovered multiple security issues in various X.org libraries and components. An attacker could use these issues to cause applications to crash, resulting in a denial of service, or possibly execute arbitrary code.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

freedesktop.org reports :

Ilja van Sprundel, a security researcher with IOActive, has discovered a large number of issues in the way various X client libraries handle the responses they receive from servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues.

Most of these issues stem from the client libraries trusting the server to send correct protocol data, and not verifying that the values will not overflow or cause other damage. Most of the time X clients & servers are run by the same user, with the server more privileged from the clients, so this is not a problem, but there are scenarios in which a privileged client can be connected to an unprivileged server, for instance, connecting a setuid X client (such as a screen lock program) to a virtual X server (such as Xvfb or Xephyr) which the user has modified to return invalid data, potentially allowing the user to escalate their privileges.

The vulnerabilities include :

Integer overflows calculating memory needs for replies.

Sign extension issues calculating memory needs for replies.

Buffer overflows due to not validating length or offset values in replies.

Integer overflows parsing user-specified files.

Unbounded recursion parsing user-specified files.

Memory corruption due to unchecked return values.

- Fix integer overflow in libchromeXvMC (CVE-2013-1994).

    - Various bug fixes and improvements. Update to latest       upstream release. For details, see       http://cgit.freedesktop.org/openchrome/xf86-video-open       chrome/tree/NEWS?id=release_0_3_3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to privilege escalation or denial of service.

ID	Name	Product	Family	Severity
401153	Alpine: multiple xf86-video-openchrome packages: security update to 0.3.2-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
401153	Alpine: multiple xf86-video-openchrome packages: security update to 0.3.2-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
74028	GLSA-201405-07 : X.Org X Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
66858	Ubuntu 12.04 LTS / 12.10 / 13.04 : xserver-xorg-video-openchrome, xserver-xorg-video-openchrome-lts-quantal vulnerability (USN-1871-1)	Nessus	Ubuntu Local Security Checks	medium
66798	FreeBSD : xorg -- protocol handling issues in X Window System client libraries (2eebebff-cd3b-11e2-8f09-001b38c3836c)	Nessus	FreeBSD Local Security Checks	medium
66733	Fedora 17 : xorg-x11-drv-openchrome-0.3.3-1.fc17 (2013-9138)	Nessus	Fedora Local Security Checks	medium
66730	Fedora 18 : xorg-x11-drv-openchrome-0.3.3-1.fc18 (2013-9114)	Nessus	Fedora Local Security Checks	medium
66728	Fedora 19 : xorg-x11-drv-openchrome-0.3.3-1.fc19 (2013-8991)	Nessus	Fedora Local Security Checks	medium
66563	Debian DSA-2679-1 : xserver-xorg-video-openchrome - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-1994

critical

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium