Hello,
I am writing in my capacity as the Debian XFree86 package maintainer for
Debian 3.0 ("woody") to correct a factual error I encountered on the
following web page:
<URL: http://www.securityfocus.com/bid/5735/info/ >
This entry lists the following releases of Debian GNU/Linux as vulnerable:
XFree86 X11R6 4.1.0
+ Debian Linux 3.0
+ Debian Linux 3.0 alpha
+ Debian Linux 3.0 arm
+ Debian Linux 3.0 hppa
+ Debian Linux 3.0 ia-32
+ Debian Linux 3.0 ia-64
+ Debian Linux 3.0 m68k
+ Debian Linux 3.0 mips
+ Debian Linux 3.0 mipsel
+ Debian Linux 3.0 ppc
+ Debian Linux 3.0 s/390
+ Debian Linux 3.0 sparc
Stock XFree86 4.1.0, and XFree86 4.1.0 as patched and shipped by Debian in
our 3.0 ("woody") release, was not vulnerable to this flaw.
This is because the flaw was in the Xlib internationalization module
loader. This module loader was only added to XFree86 very late in the
XFree86 4.2.0 development cycle[1], and was *not* present in XFree86 4.1.0.
Furthermore, Debian did not backport this functionality to our official
packages of XFree86 4.1.0.
It is possible that the other distributions you have listed as shipping
XFree86 4.1.0 are not vulnerable either:
+ RedHat Advanced Workstation for the Itanium Processor 2.1
+ RedHat Enterprise Linux AS 2.1
+ RedHat Enterprise Linux ES 2.1
+ RedHat Enterprise Linux WS 2.1
+ RedHat Linux 7.1 i386
+ RedHat Linux 7.2 i386
+ Turbolinux Turbolinux Server 7.0
+ Turbolinux Turbolinux Workstation 7.0
...however, I am not familiar with those releases, and it is possible that
Red Hat and/or Turbolinux backported the Xlib module loader to their
versions of XFree86 4.1.0.
I have two further, more cosmetic, corrections to offer:
* The name of Debian's Linux-kernel-based OS release is "Debian GNU/Linux",
not "Debian Linux". When our versions of "GNU/Hurd", "GNU/FreeBSD", and
other OSes are available, we'll let you know. :)
* The name of The XFree86 Project, Inc.'s releases are simply "XFree86".
It is X.Org that produces "X11R6". This is an important distinction
given recent developments in the free software community.
Thanks for your attention to this matter.
[1] Here's the relevant CVS commit message, which unfortunately is not
publicly archived on the World Wide Web, as far as I can tell:
From: David Dawes <dawes@XFree86.Org>
To: cvs-commit@xfree86.org
Subject: CVS Update: xc (branch: trunk)
Date: Thu, 15 Nov 2001 16:52:35 -0800 (PST)
Message-Id: <200111160052.fAG0qZw17606@public.xfree86.org>
List-Id: CVS commit messages <cvs-commit.XFree86.Org>
CVSROOT: /home/x-cvs
Module name: xc
Changes by: dawes@public.xfree86.org. 01/11/15 16:52:35
Log message:
479. Move much of the I18N code in Xlib into separately loadable
modules (#4965, 5043, Ernie Coskrey, from X11R6.6).
Modified files:
xc/config/cf/:
X11.tmpl cygwin.tmpl
xc/lib/X11/:
Imakefile XlcPubI.h Xlcint.h imInt.c lcFile.c lcGeneric.c
lcInit.c lcPublic.c lcUTF8.c
xc/nls/:
Imakefile
xc/programs/Xserver/hw/xfree86/:
CHANGELOG
Added files:
xc/lib/X11/xlibi18n/:
Imakefile Xi18nLib.conf
xc/lib/X11/xlibi18n/im/:
Imakefile
xc/lib/X11/xlibi18n/im/ximcp/:
Imakefile Ximcp.mapfile
xc/lib/X11/xlibi18n/lc/:
Imakefile
xc/lib/X11/xlibi18n/lc/Utf8/:
Imakefile
xc/lib/X11/xlibi18n/lc/def/:
Imakefile Xlc.mapfile
xc/lib/X11/xlibi18n/lc/gen/:
Imakefile Xlc.mapfile
xc/lib/X11/xlibi18n/lc/xlocale/:
Imakefile
xc/lib/X11/xlibi18n/om/:
Imakefile
xc/lib/X11/xlibi18n/om/generic/:
Imakefile Xom.mapfile
xc/nls/XI18N_OBJS/:
C Imakefile armscii-8 en_US.UTF-8 georgian-academy
georgian-ps ibm-cp1133 iscii-dev isiri-3342 iso8859-1
iso8859-10 iso8859-13 iso8859-14 iso8859-15 iso8859-2
iso8859-3 iso8859-4 iso8859-5 iso8859-6 iso8859-7
iso8859-8 iso8859-9 iso8859-9e ja ja.JIS ja.S90 ja.SJIS
ja.U90 ko koi8-c koi8-r koi8-u microsoft-cp1251
microsoft-cp1255 microsoft-cp1256 mulelao-1 nokhchi-1
tatar-cyr th_TH tscii-0 vi_VN.tcvn vi_VN.viscii zh
zh_CN.gbk zh_HK.big5hkscs zh_TW zh_TW.big5
Revision Changes Path
1.134 +4 -1 xc/config/cf/X11.tmpl
3.9 +6 -2 xc/config/cf/cygwin.tmpl
3.41 +89 -40 xc/lib/X11/Imakefile
3.9 +9 -2 xc/lib/X11/XlcPubI.h
3.11 +11 -2 xc/lib/X11/Xlcint.h
3.10 +2 -2 xc/lib/X11/imInt.c
3.24 +59 -2 xc/lib/X11/lcFile.c
3.16 +23 -2 xc/lib/X11/lcGeneric.c
3.9 +58 -2 xc/lib/X11/lcInit.c
1.11 +10 -2 xc/lib/X11/lcPublic.c
1.14 +10 -23 xc/lib/X11/lcUTF8.c
1.9 +6 -2 xc/nls/Imakefile
3.2043 +11 -1 xc/programs/Xserver/hw/xfree86/CHANGELOG
As far as I can tell, XFree86 4.1.0 was released on or about 18 May 2001.
The above commit came about 6 months later.
--
G. Branden Robinson | People with power understand
Debian GNU/Linux | exactly one thing: violence.
branden@debian.org | -- Noam Chomsky
http://people.debian.org/~branden/ |
Attachment:
signature.asc
Description: Digital signature