Wed Dec 15 04:34:02 UTC 202120211215043402

a/dialog-1.3_20211214-x86_64-1.txz:  Upgraded.
a/kernel-generic-5.15.8-x86_64-1.txz:  Upgraded.
a/kernel-huge-5.15.8-x86_64-1.txz:  Upgraded.
a/kernel-modules-5.15.8-x86_64-1.txz:  Upgraded.
a/sysvinit-3.01-x86_64-1.txz:  Upgraded.
d/kernel-headers-5.15.8-x86-1.txz:  Upgraded.
d/patchelf-0.14.3-x86_64-1.txz:  Upgraded.
k/kernel-source-5.15.8-noarch-1.txz:  Upgraded.
l/oniguruma-6.9.7.1-x86_64-1.txz:  Upgraded.
l/pipewire-0.3.41-x86_64-1.txz:  Upgraded.
x/libinput-1.19.3-x86_64-1.txz:  Upgraded.
x/xorg-server-1.20.13-x86_64-2.txz:  Rebuilt.
  Fixes for multiple input validation failures in X server extensions:
  render: Fix out of bounds access in SProcRenderCompositeGlyphs()
  xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
  Xext: Fix out of bounds access in SProcScreenSaverSuspend()
  record: Fix out of bounds access in SwapCreateRegister()
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4008
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4009
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4010
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4011
  (* Security fix *)
x/xorg-server-xephyr-1.20.13-x86_64-2.txz:  Rebuilt.
x/xorg-server-xnest-1.20.13-x86_64-2.txz:  Rebuilt.
x/xorg-server-xvfb-1.20.13-x86_64-2.txz:  Rebuilt.
x/xorg-server-xwayland-21.1.4-x86_64-1.txz:  Upgraded.
  Fixes for multiple input validation failures in X server extensions:
  render: Fix out of bounds access in SProcRenderCompositeGlyphs()
  xfixes: Fix out of bounds access in *ProcXFixesCreatePointerBarrier()
  Xext: Fix out of bounds access in SProcScreenSaverSuspend()
  record: Fix out of bounds access in SwapCreateRegister()
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4008
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4009
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4010
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4011
  (* Security fix *)
xap/xsnow-3.4.1-x86_64-1.txz:  Upgraded.
isolinux/initrd.img:  Rebuilt.
kernels/*:  Upgraded.
usb-and-pxe-installers/usbboot.img:  Rebuilt.

1 files changed, 52 insertions, 0 deletions

diff --git a/source/x/x11/patch/xorg-server/xorg-server.CVE-2021-4008.ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60.patch b/source/x/x11/patch/xorg-server/xorg-server.CVE-2021-4008.ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60.patch
new file mode 100644
index 000000000..e13edff70
--- /dev/null
+++ b/source/x/x11/patch/xorg-server/xorg-server.CVE-2021-4008.ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60.patch
@@ -0,0 +1,52 @@
+From ebce7e2d80e7c80e1dda60f2f0bc886f1106ba60 Mon Sep 17 00:00:00 2001
+From: Povilas Kanapickas <povilas@radix.lt>
+Date: Tue, 14 Dec 2021 15:00:03 +0200
+Subject: [PATCH] render: Fix out of bounds access in
+ SProcRenderCompositeGlyphs()
+
+ZDI-CAN-14192, CVE-2021-4008
+
+This vulnerability was discovered and the fix was suggested by:
+Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
+
+Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
+---
+ render/render.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/render/render.c b/render/render.c
+index c376090ca..456f156d4 100644
+--- a/render/render.c
++++ b/render/render.c
+@@ -2309,6 +2309,9 @@ SProcRenderCompositeGlyphs(ClientPtr client)
+ 
+         i = elt->len;
+         if (i == 0xff) {
++            if (buffer + 4 > end) {
++                return BadLength;
++            }
+             swapl((int *) buffer);
+             buffer += 4;
+         }
+@@ -2319,12 +2322,18 @@ SProcRenderCompositeGlyphs(ClientPtr client)
+                 buffer += i;
+                 break;
+             case 2:
++                if (buffer + i * 2 > end) {
++                    return BadLength;
++                }
+                 while (i--) {
+                     swaps((short *) buffer);
+                     buffer += 2;
+                 }
+                 break;
+             case 4:
++                if (buffer + i * 4 > end) {
++                    return BadLength;
++                }
+                 while (i--) {
+                     swapl((int *) buffer);
+                     buffer += 4;
+-- 
+GitLab
+