type: security subject: Updated X.org packages fix multiple security vulnerabilities CVE: - CVE-2013-1872 - CVE-2013-1981 - CVE-2013-1982 - CVE-2013-1983 - CVE-2013-1984 - CVE-2013-1985 - CVE-2013-1986 - CVE-2013-1987 - CVE-2013-1988 - CVE-2013-1989 - CVE-2013-1990 - CVE-2013-1991 - CVE-2013-1992 - CVE-2013-1993 - CVE-2013-1994 - CVE-2013-1995 - CVE-2013-1996 - CVE-2013-1997 - CVE-2013-1998 - CVE-2013-1999 - CVE-2013-2000 - CVE-2013-2001 - CVE-2013-2002 - CVE-2013-2003 - CVE-2013-2004 - CVE-2013-2005 - CVE-2013-2062 - CVE-2013-2063 - CVE-2013-2064 - CVE-2013-2066 src: 3: core: - libdmx-1.1.3-1.mga3 - libfs-1.0.5-1.mga3 - libx11-1.5.99.902-1.mga3 - libxcb-1.9.1-1.mga3 - libxcursor-1.1.14-1.mga3 - libxext-1.3.2-1.mga3 - libxfixes-5.0.1-1.mga3 - libxi-1.6.2.901-1.mga3 - libxinerama-1.1.3-1.mga3 - libxp-1.0.2-1.mga3 - libxrandr-1.4.1-1.mga3 - libxrender-0.9.8-1.mga3 - libxres-1.0.7-1.mga3 - libxt-1.1.4-1.mga3 - libxtst-1.2.2-1.mga3 - libxv-1.0.8-1.mga3 - libxvmc-1.0.8-1.mga3 - libxxf86dga-1.1.4-1.mga3 - libxxf86vm-1.1.3-1.mga3 - mesa-9.1.3-1.1.mga3 - x11-driver-video-openchrome-0.3.3-1.mga3 tainted: - mesa-9.1.3-1.1.mga3.tainted description: | Ilja van Sprundel of IOActive discovered several security issues in multiple components of the X.org graphics stack and the related libraries: Various integer overflows, sign handling errors in integer conversions, buffer overflows, memory corruption and missing input sanitising may lead to privilege escalation or denial of service (CVE-2013-1981, CVE-2013-1982, CVE-2013-1983, CVE-2013-1984, CVE-2013-1985, CVE-2013-1986, CVE-2013-1987, CVE-2013-1988, CVE-2013-1989, CVE-2013-1990, CVE-2013-1991, CVE-2013-1992, CVE-2013-1993, CVE-2013-1994, CVE-2013-1995, CVE-2013-1996, CVE-2013-1997, CVE-2013-1998, CVE-2013-1999, CVE-2013-2000, CVE-2013-2001, CVE-2013-2002, CVE-2013-2003, CVE-2013-2004, CVE-2013-2005, CVE-2013-2062, CVE-2013-2063, CVE-2013-2064, CVE-2013-2066). An out-of-bounds access flaw was found in Mesa. If an application using Mesa exposed the Mesa API to untrusted inputs (Mozilla Firefox does this), an attacker could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application (CVE-2013-1872). references: - http://www.x.org/wiki/Development/Security/Advisory-2013-05-23 - https://rhn.redhat.com/errata/RHSA-2013-0897.html - http://www.debian.org/security/2013/dsa-2673 - http://www.debian.org/security/2013/dsa-2674 - http://www.debian.org/security/2013/dsa-2675 - http://www.debian.org/security/2013/dsa-2676 - http://www.debian.org/security/2013/dsa-2677 - http://www.debian.org/security/2013/dsa-2678 - http://www.debian.org/security/2013/dsa-2679 - http://www.debian.org/security/2013/dsa-2680 - http://www.debian.org/security/2013/dsa-2681 - http://www.debian.org/security/2013/dsa-2682 - http://www.debian.org/security/2013/dsa-2683 - http://www.debian.org/security/2013/dsa-2684 - http://www.debian.org/security/2013/dsa-2685 - http://www.debian.org/security/2013/dsa-2686 - http://www.debian.org/security/2013/dsa-2687 - http://www.debian.org/security/2013/dsa-2688 - http://www.debian.org/security/2013/dsa-2689 - http://www.debian.org/security/2013/dsa-2690 - http://www.debian.org/security/2013/dsa-2691 - http://www.debian.org/security/2013/dsa-2692 - http://www.debian.org/security/2013/dsa-2693 - https://bugs.mageia.org/show_bug.cgi?id=10565 ID: MGASA-2013-0186