Amazon Linux AMI : libX11 / libXcursor,libXfixes,libXi,libXrandr,libXrender,libXres,libXt,libXv,libXvMC,libXxf86dga,libXxf86vm,libdmx,xorg-x11-proto-devel (ALAS-2014-452)

Medium Nessus Plugin ID 79560

Synopsis

The remote Amazon Linux AMI host is missing a security update.

Description

Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in the way various X11 client libraries handled certain protocol data. An attacker able to submit invalid protocol data to an X11 server via a malicious X11 client could use either of these flaws to potentially escalate their privileges on the system.
(CVE-2013-1981 , CVE-2013-1982 , CVE-2013-1983 , CVE-2013-1984 , CVE-2013-1985 , CVE-2013-1986 , CVE-2013-1987 , CVE-2013-1988 , CVE-2013-1989 , CVE-2013-1990 , CVE-2013-1991 , CVE-2013-2003 , CVE-2013-2062 , CVE-2013-2064)

Multiple array index errors, leading to heap-based buffer out-of-bounds write flaws, were found in the way various X11 client libraries handled data returned from an X11 server. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client. (CVE-2013-1997 , CVE-2013-1998 , CVE-2013-1999 , CVE-2013-2000 , CVE-2013-2001 , CVE-2013-2002 , CVE-2013-2066)

A buffer overflow flaw was found in the way the XListInputDevices() function of X.Org X11's libXi runtime library handled signed numbers.
A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client.
(CVE-2013-1995)

A flaw was found in the way the X.Org X11 libXt runtime library used uninitialized pointers. A malicious X11 server could possibly use this flaw to execute arbitrary code with the privileges of the user running an X11 client. (CVE-2013-2005)

Two stack-based buffer overflow flaws were found in the way libX11, the Core X11 protocol client library, processed certain user-specified files. A malicious X11 server could possibly use this flaw to crash an X11 client via a specially crafted file. (CVE-2013-2004)

Solution

Run 'yum update libX11 libXcursor libXfixes libXi libXrandr libXrender libXres libXt libXv libXvMC libXxf86dga libXxf86vm libdmx xorg-x11-proto-devel' to update your system.

See Also

https://alas.aws.amazon.com/ALAS-2014-452.html

Plugin Details

Severity: Medium

ID: 79560

File Name: ala_ALAS-2014-452.nasl

Version: 1.4

Type: local

Agent: unix

Published: 2014/11/26

Updated: 2019/07/10

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:amazon:linux:libX11, p-cpe:/a:amazon:linux:libX11-common, p-cpe:/a:amazon:linux:libX11-debuginfo, p-cpe:/a:amazon:linux:libX11-devel, p-cpe:/a:amazon:linux:libXcursor, p-cpe:/a:amazon:linux:libXcursor-debuginfo, p-cpe:/a:amazon:linux:libXcursor-devel, p-cpe:/a:amazon:linux:libXfixes, p-cpe:/a:amazon:linux:libXfixes-debuginfo, p-cpe:/a:amazon:linux:libXfixes-devel, p-cpe:/a:amazon:linux:libXi, p-cpe:/a:amazon:linux:libXi-debuginfo, p-cpe:/a:amazon:linux:libXi-devel, p-cpe:/a:amazon:linux:libXrandr, p-cpe:/a:amazon:linux:libXrandr-debuginfo, p-cpe:/a:amazon:linux:libXrandr-devel, p-cpe:/a:amazon:linux:libXrender, p-cpe:/a:amazon:linux:libXrender-debuginfo, p-cpe:/a:amazon:linux:libXrender-devel, p-cpe:/a:amazon:linux:libXres, p-cpe:/a:amazon:linux:libXres-debuginfo, p-cpe:/a:amazon:linux:libXres-devel, p-cpe:/a:amazon:linux:libXt, p-cpe:/a:amazon:linux:libXt-debuginfo, p-cpe:/a:amazon:linux:libXt-devel, p-cpe:/a:amazon:linux:libXv, p-cpe:/a:amazon:linux:libXv-debuginfo, p-cpe:/a:amazon:linux:libXv-devel, p-cpe:/a:amazon:linux:libXvMC, p-cpe:/a:amazon:linux:libXvMC-debuginfo, p-cpe:/a:amazon:linux:libXvMC-devel, p-cpe:/a:amazon:linux:libXxf86dga, p-cpe:/a:amazon:linux:libXxf86dga-debuginfo, p-cpe:/a:amazon:linux:libXxf86dga-devel, p-cpe:/a:amazon:linux:libXxf86vm, p-cpe:/a:amazon:linux:libXxf86vm-debuginfo, p-cpe:/a:amazon:linux:libXxf86vm-devel, p-cpe:/a:amazon:linux:libdmx, p-cpe:/a:amazon:linux:libdmx-debuginfo, p-cpe:/a:amazon:linux:libdmx-devel, p-cpe:/a:amazon:linux:xorg-x11-proto-devel, cpe:/o:amazon:linux

Required KB Items: Host/local_checks_enabled, Host/AmazonLinux/release, Host/AmazonLinux/rpm-list

Patch Publication Date: 2014/11/24

Vulnerability Publication Date: 2013/06/15

Reference Information

CVE: CVE-2013-1981, CVE-2013-1982, CVE-2013-1983, CVE-2013-1984, CVE-2013-1985, CVE-2013-1986, CVE-2013-1987, CVE-2013-1988, CVE-2013-1989, CVE-2013-1990, CVE-2013-1991, CVE-2013-1995, CVE-2013-1997, CVE-2013-1998, CVE-2013-1999, CVE-2013-2000, CVE-2013-2001, CVE-2013-2002, CVE-2013-2003, CVE-2013-2004, CVE-2013-2005, CVE-2013-2062, CVE-2013-2064, CVE-2013-2066

ALAS: 2014-452

RHSA: 2014:1436