Bugzilla – Bug 1217765
VUL-0: CVE-2023-6377: xorg-x11-server,xwayland: Out-of-bounds memory write in XKB button actions
Last modified: 2024-05-28 11:52:57 UTC
Created attachment 871125 [details] 0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch 0001-Xi-allocate-enough-XkbActions-for-our-buttons.patch
I've just submitted xorg-x11-server and xwayland updates for sle15-sp5,sp4,sp2 and sle12-sp5. Unfortunately I'm already on vacation on CRD next wekk. I'll update devel project X11:XOrg, factory/TW, SP6 and ALP when I'm back on January 8th.
public CVE-2023-6377 has following references: CVE-2023-6377: https://www.cve.org/CVERecord?id=CVE-2023-6377 https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd: https://gitlab.freedesktop.org/xorg/xserver/-/commit/0c1a93d319558fe3ab2d94f51d174b4f93810afd https://lists.x.org/archives/xorg-announce/2023-December/003435.html: https://lists.x.org/archives/xorg-announce/2023-December/003435.html
This is an autogenerated message for OBS integration: This bug (1217765) was mentioned in https://build.opensuse.org/request/show/1132832 Factory / xwayland https://build.opensuse.org/request/show/1132834 Factory / xorg-x11-server
Hi Thomas. I've just updated the fix for: * SLE-15-SP5 * SLE-15-SP4 * SLE-15-SP2 * SLE-12-SP5 And also it's added to: * openSUSE:Factory * SLE-15-SP6 * ALP
(In reply to Joan Torres from comment #11) > Hi Thomas. > I've just updated the fix for: > * SLE-15-SP5 > * SLE-15-SP4 > * SLE-15-SP2 > * SLE-12-SP5 > > And also it's added to: > * openSUSE:Factory > * SLE-15-SP6 > * ALP Thanks for your quick move Joan. I got confirmation from X.Org maintainers that the first fix was incomplete, and not introducing a regression, so we released Stefan's SRs with patch v1. The SRs were also correctly fixing CVE-2023-6478. Therefore, your very new SRs are now broken... Could you please re-submit for * SLE-15-SP5 * SLE-15-SP4 * SLE-15-SP2 * SLE-12-SP5 again please? :)
(In reply to Thomas Leroy from comment #13) > Thanks for your quick move Joan. I got confirmation from X.Org maintainers > that the first fix was incomplete, and not introducing a regression, so we > released Stefan's SRs with patch v1. The SRs were also correctly fixing > CVE-2023-6478. > Therefore, your very new SRs are now broken... Could you please re-submit for > * SLE-15-SP5 > * SLE-15-SP4 > * SLE-15-SP2 > * SLE-12-SP5 > again please? :) Done.
SUSE-SU-2023:4792-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1217765, 1217766 CVE References: CVE-2023-6377, CVE-2023-6478 Sources used: openSUSE Leap 15.4 (src): xwayland-21.1.4-150400.3.23.1 SUSE Linux Enterprise Workstation Extension 15 SP4 (src): xwayland-21.1.4-150400.3.23.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4791-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1217765, 1217766 CVE References: CVE-2023-6377, CVE-2023-6478 Sources used: openSUSE Leap 15.4 (src): xorg-x11-server-1.20.3-150400.38.32.1 Basesystem Module 15-SP4 (src): xorg-x11-server-1.20.3-150400.38.32.1 Development Tools Module 15-SP4 (src): xorg-x11-server-1.20.3-150400.38.32.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4790-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1217765, 1217766 CVE References: CVE-2023-6377, CVE-2023-6478 Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): xorg-x11-server-1.19.6-10.59.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): xorg-x11-server-1.19.6-10.59.1 SUSE Linux Enterprise Server 12 SP5 (src): xorg-x11-server-1.19.6-10.59.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): xorg-x11-server-1.19.6-10.59.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4789-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1217765, 1217766 CVE References: CVE-2023-6377, CVE-2023-6478 Sources used: openSUSE Leap 15.4 (src): xorg-x11-server-1.20.3-150200.22.5.82.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): xorg-x11-server-1.20.3-150200.22.5.82.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): xorg-x11-server-1.20.3-150200.22.5.82.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): xorg-x11-server-1.20.3-150200.22.5.82.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): xorg-x11-server-1.20.3-150200.22.5.82.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): xorg-x11-server-1.20.3-150200.22.5.82.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): xorg-x11-server-1.20.3-150200.22.5.82.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): xorg-x11-server-1.20.3-150200.22.5.82.1 SUSE Linux Enterprise Workstation Extension 15 SP4 (src): xorg-x11-server-1.20.3-150200.22.5.82.1 SUSE Linux Enterprise Workstation Extension 15 SP5 (src): xorg-x11-server-1.20.3-150200.22.5.82.1 SUSE Enterprise Storage 7.1 (src): xorg-x11-server-1.20.3-150200.22.5.82.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4788-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1217765, 1217766 CVE References: CVE-2023-6377, CVE-2023-6478 Sources used: openSUSE Leap 15.5 (src): xwayland-22.1.5-150500.7.8.1 SUSE Linux Enterprise Workstation Extension 15 SP5 (src): xwayland-22.1.5-150500.7.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4787-1: An update that solves two vulnerabilities can now be installed. Category: security (important) Bug References: 1217765, 1217766 CVE References: CVE-2023-6377, CVE-2023-6478 Sources used: openSUSE Leap 15.5 (src): xorg-x11-server-21.1.4-150500.7.10.1 Basesystem Module 15-SP5 (src): xorg-x11-server-21.1.4-150500.7.10.1 Development Tools Module 15-SP5 (src): xorg-x11-server-21.1.4-150500.7.10.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4926-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1217765 CVE References: CVE-2023-6377 Sources used: openSUSE Leap 15.4 (src): xwayland-21.1.4-150400.3.26.1 SUSE Linux Enterprise Workstation Extension 15 SP4 (src): xwayland-21.1.4-150400.3.26.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4925-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1217765 CVE References: CVE-2023-6377 Sources used: openSUSE Leap 15.5 (src): xorg-x11-server-21.1.4-150500.7.13.1 Basesystem Module 15-SP5 (src): xorg-x11-server-21.1.4-150500.7.13.1 Development Tools Module 15-SP5 (src): xorg-x11-server-21.1.4-150500.7.13.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4935-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1217765 CVE References: CVE-2023-6377 Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): xorg-x11-server-1.19.6-10.62.1 SUSE Linux Enterprise High Performance Computing 12 SP5 (src): xorg-x11-server-1.19.6-10.62.1 SUSE Linux Enterprise Server 12 SP5 (src): xorg-x11-server-1.19.6-10.62.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5 (src): xorg-x11-server-1.19.6-10.62.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4934-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1217765 CVE References: CVE-2023-6377 Sources used: SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): xorg-x11-server-1.20.3-150200.22.5.85.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): xorg-x11-server-1.20.3-150200.22.5.85.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): xorg-x11-server-1.20.3-150200.22.5.85.1 SUSE Linux Enterprise Workstation Extension 15 SP4 (src): xorg-x11-server-1.20.3-150200.22.5.85.1 SUSE Linux Enterprise Workstation Extension 15 SP5 (src): xorg-x11-server-1.20.3-150200.22.5.85.1 SUSE Enterprise Storage 7.1 (src): xorg-x11-server-1.20.3-150200.22.5.85.1 openSUSE Leap 15.4 (src): xorg-x11-server-1.20.3-150200.22.5.85.1 SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): xorg-x11-server-1.20.3-150200.22.5.85.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): xorg-x11-server-1.20.3-150200.22.5.85.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): xorg-x11-server-1.20.3-150200.22.5.85.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): xorg-x11-server-1.20.3-150200.22.5.85.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4933-1: An update that has one security fix can now be installed. Category: security (important) Bug References: 1217765 Sources used: openSUSE Leap 15.5 (src): xwayland-22.1.5-150500.7.11.1 SUSE Linux Enterprise Workstation Extension 15 SP5 (src): xwayland-22.1.5-150500.7.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4949-1: An update that solves one vulnerability can now be installed. Category: security (important) Bug References: 1217765 CVE References: CVE-2023-6377 Sources used: Basesystem Module 15-SP4 (src): xorg-x11-server-1.20.3-150400.38.35.1 Development Tools Module 15-SP4 (src): xorg-x11-server-1.20.3-150400.38.35.1 openSUSE Leap 15.4 (src): xorg-x11-server-1.20.3-150400.38.35.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Reassigning to security team.
This is an autogenerated message for OBS integration: This bug (1217765) was mentioned in https://build.opensuse.org/request/show/1139316 Factory / xwayland
This is an autogenerated message for OBS integration: This bug (1217765) was mentioned in https://build.opensuse.org/request/show/1139423 Factory / xwayland
This is an autogenerated message for OBS integration: This bug (1217765) was mentioned in https://build.opensuse.org/request/show/1146120 Factory / xorg-x11-server
Done, closing.