Bug#988737: libx11: CVE-2021-31535: Missing request length checks
Control: severity -1 grave
Hi,
On Tue, May 18, 2021 at 09:13:18PM +0200, Salvatore Bonaccorso wrote:
> Source: libx11
> Version: 2:1.7.0-2
> Severity: important
> Tags: security upstream
> X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
>
> Hi,
>
> The following vulnerability was published for libx11.
>
> CVE-2021-31535[0]:
> | Missing request length checks
>
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
>
> For further information see:
>
> [0] https://security-tracker.debian.org/tracker/CVE-2021-31535
> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31535
> [1] https://www.openwall.com/lists/oss-security/2021/05/18/2
> [2] https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53deb625211a0527126c605
> [3] https://bugzilla.suse.com/show_bug.cgi?id=1182506
Raising the severity to RC, even if for bullseye/unstable the xterm
case is mitigated due we have a version with patch #367 applied.
Regards,
Salvatore
Reply to: