Package "xorg-server"
Name: |
xorg-server
|
Description: |
This package is just an umbrella for a group of other packages,
it has no description. Description samples from packages in group:
- distributed multihead X server
- Distributed Multihead X tools
- Nested X server
- Xorg X server - source files
|
Latest version: |
2:1.15.1-0ubuntu2.11 |
Release: |
trusty (14.04) |
Level: |
updates |
Repository: |
universe |
Links
Other versions of "xorg-server" in Trusty
Packages in group
Deleted packages are displayed in grey.
Changelog
xorg-server (2:1.15.1-0ubuntu2.11) trusty-security; urgency=medium
* SECURITY UPDATE: unvalidated extra length in ProcEstablishConnection
- debian/patches/CVE-2017-12176.patch: add check to dix/dispatch.c.
- CVE-2017-12176
* SECURITY UPDATE: Unvalidated variable-length request in
ProcDbeGetVisualInfo
- debian/patches/CVE-2017-12177.patch: add check to dbe/dbe.c.
- CVE-2017-12177
* SECURITY UPDATE: wrong extra length check in ProcXIChangeHierarchy
- debian/patches/CVE-2017-12178.patch: fix length check in
Xi/xichangehierarchy.c.
- CVE-2017-12178
* SECURITY UPDATE: integer overflow and unvalidated length in
ProcXIBarrierReleasePointer
- debian/patches/CVE-2017-12179-1.patch: test exact size of
XIBarrierReleasePointer in Xi/xibarriers.c.
- debian/patches/CVE-2017-12179-2.patch: add checks to Xi/xibarriers.c.
- CVE-2017-12179
* SECURITY UPDATE: various unvalidated lengths
- debian/patches/CVE-2017-12180-12182.patch: add more checks to
hw/xfree86/common/xf86vmode.c, hw/xfree86/common/xf86DGA.c,
hw/xfree86/dri/xf86dri.c.
- CVE-2017-12180
- CVE-2017-12181
- CVE-2017-12182
* SECURITY UPDATE: more unvalidated lengths
- debian/patches/CVE-2017-12183.patch: add checks to xfixes/cursor.c,
xfixes/region.c, xfixes/saveset.c, xfixes/xfixes.c.
- CVE-2017-12183
* SECURITY UPDATE: even more unvalidated lengths
- debian/patches/CVE-2017-12184-12187.patch: add more checks to
Xext/panoramiX.c, Xext/saver.c, Xext/xres.c, Xext/xvdisp.c,
hw/dmx/dmxpict.c, pseudoramiX/pseudoramiX.c, render/render.c.
- CVE-2017-12184
- CVE-2017-12185
- CVE-2017-12186
- CVE-2017-12187
* debian/patches/os_big_requests.patch: make sure big requests have
sufficient length in os/io.c.
* debian/patches/xkb_escape_fix.patch: escape non-printable characters
correctly in xkb/xkbtext.c.
-- Marc Deslauriers <email address hidden> Fri, 13 Oct 2017 08:44:17 -0400
|
Source diff to previous version |
CVE-2017-1217 |
IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web |
CVE-2017-1218 |
IBM Tivoli Endpoint Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions t |
|
xorg-server (2:1.15.1-0ubuntu2.10) trusty-security; urgency=medium
* SECURITY UPDATE: DoS or segment overwrite via shmseg resource id
- debian/patches/CVE-2017-13721.patch: validate shmseg resource id in
Xext/shm.c.
- CVE-2017-13721
* SECURITY UPDATE: buffer overflow via XKB data
- debian/patches/CVE-2017-13723.patch: handle xkb formatted string
output safely in xkb/xkbtext.c.
- CVE-2017-13723
* This update does _not_ contain the changes from 2:1.18.4-0ubuntu0.5 in
xenial-proposed.
-- Marc Deslauriers <email address hidden> Wed, 11 Oct 2017 13:28:52 -0400
|
Source diff to previous version |
CVE-2017-1372 |
IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri |
|
xorg-server (2:1.15.1-0ubuntu2.9) trusty-security; urgency=medium
* SECURITY UPDATE: DoS and possible code execution in endianness
conversion of X Events
- debian/patches/CVE-2017-10971-1.patch: do not try to swap
GenericEvent in Xi/sendexev.c.
- debian/patches/CVE-2017-10971-2.patch: verify all events in
ProcXSendExtensionEvent in Xi/sendexev.c.
- debian/patches/CVE-2017-10971-3.patch: disallow GenericEvent in
SendEvent request in dix/events.c, dix/swapreq.c.
- CVE-2017-10971
* SECURITY UPDATE: information leak in XEvent handling
- debian/patches/CVE-2017-10972.patch: zero target buffer in
SProcXSendExtensionEvent in Xi/sendexev.c.
- CVE-2017-10972
* SECURITY UPDATE: MIT-MAGIC-COOKIES timing attack
- debian/patches/CVE-2017-2624.patch: use timingsafe_memcmp() in
configure.ac, include/dix-config.h.in, include/os.h,
os/mitauth.c, os/timingsafe_memcmp.c.
- CVE-2017-2624
* debian/patches/fix_test_failure.patch: fix ftbfs on armhf due to
uninitialized values.
-- Marc Deslauriers <email address hidden> Thu, 20 Jul 2017 14:44:38 -0400
|
Source diff to previous version |
|
xorg-server (2:1.15.1-0ubuntu2.7) trusty-security; urgency=medium
* SECURITY UPDATE: information leak and denial of service in
XkbSetGeometry
- debian/patches/CVE-2015-0255.patch: properly check lengths in
xkb/xkb.c.
- CVE-2015-0255
* debian/patches/CVE-2014-8xxx/0038-CVE-2014-8092-*: fix regression in
previous security update by allowing zero-height PutImage requests in
dix/dispatch.c.
-- Marc Deslauriers <email address hidden> Thu, 12 Feb 2015 08:42:55 -0500
|
Source diff to previous version |
CVE-2015-0255 |
X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before 1.17.1 allows remote attackers to obtain sensitive information from proces |
CVE-2014-8092 |
intger overflows in X11 core protocol requests |
|
xorg-server (2:1.15.1-0ubuntu2.6) trusty-proposed; urgency=medium
[ La��rcio de Sousa ]
* Backport support for logind-based multiseat back to trusty. (LP: #1209008)
[ Maarten Lankhorst ]
* Re-enable support for rotation and transforms on gpu-screens with support.
- Allows re-enabling intel SNA rotation after fixing it. (LP: #1386620)
* Fix black screen when using qemu with cirrus vga.
- fb-24-depth.patch (LP: #1318119)
-- Maarten Lankhorst <email address hidden> Mon, 03 Nov 2014 12:36:32 +0100
|
1209008 |
[SRU] X doesn't work for video cards with non-KMS drivers on non-seat0 seats |
1318119 |
14.04 corrupted graphics on cirrus (in qemu) [PATCH available] |
|
About
-
Send Feedback to @ubuntu_updates