Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status

Gentoo Archives: gentoo-announce

From: Thomas Deutschmann <whissi@g.o>
To: gentoo-announce@l.g.o
Subject: [gentoo-announce] [ GLSA 202012-01 ] X.Org X Server: Multiple vulnerabilities
Date: Mon, 07 Dec 2020 00:34:31
Message-Id: 8f0a82d5-5a7b-4fc5-1035-3c4a8bf50205@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 202012-01
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 https://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: X.Org X Server: Multiple vulnerabilities
9 Date: December 07, 2020
10 Bugs: #734976, #757882
11 ID: 202012-01
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple vulnerabilities have been found in X.org X Server, the worst
19 of which could lead to privilege escalation.
20
21 Background
22 ==========
23
24 The X Window System is a graphical windowing system based on a
25 client/server model.
26
27 Affected packages
28 =================
29
30 -------------------------------------------------------------------
31 Package / Vulnerable / Unaffected
32 -------------------------------------------------------------------
33 1 x11-base/xorg-server < 1.20.10 >= 1.20.10
34
35 Description
36 ===========
37
38 Multiple vulnerabilities have been discovered in X.org X Server. Please
39 review the CVE identifiers referenced below for details.
40
41 Impact
42 ======
43
44 Please review the referenced CVE identifiers for details.
45
46 Workaround
47 ==========
48
49 A local attacker could escalate privileges.
50
51 Resolution
52 ==========
53
54 All X.org X Server users should upgrade to the latest version:
55
56 # emerge --sync
57 # emerge --ask --oneshot --verbose ">=11-base/xorg-server-1.20.10"
58
59 References
60 ==========
61
62 [ 1 ] CVE-2020-14345
63 https://nvd.nist.gov/vuln/detail/CVE-2020-14345
64 [ 2 ] CVE-2020-14346
65 https://nvd.nist.gov/vuln/detail/CVE-2020-14346
66 [ 3 ] CVE-2020-14347
67 https://nvd.nist.gov/vuln/detail/CVE-2020-14347
68 [ 4 ] CVE-2020-14360
69 https://nvd.nist.gov/vuln/detail/CVE-2020-14360
70 [ 5 ] CVE-2020-14361
71 https://nvd.nist.gov/vuln/detail/CVE-2020-14361
72 [ 6 ] CVE-2020-14362
73 https://nvd.nist.gov/vuln/detail/CVE-2020-14362
74 [ 7 ] CVE-2020-25712
75 https://nvd.nist.gov/vuln/detail/CVE-2020-25712
76 [ 8 ] Upstream advisory (2020-07-31)
77 https://lists.x.org/archives/xorg-announce/2020-July/003051.html
78 [ 9 ] Upstream advisory (2020-08-25)
79 https://lists.x.org/archives/xorg-announce/2020-August/003058.html
80 [ 10 ] Upstream advisory (2020-12-01)
81 https://lists.x.org/archives/xorg-announce/2020-December/003066.html
82
83 Availability
84 ============
85
86 This GLSA and any updates to it are available for viewing at
87 the Gentoo Security Website:
88
89 https://security.gentoo.org/glsa/202012-01
90
91 Concerns?
92 =========
93
94 Security is a primary focus of Gentoo Linux and ensuring the
95 confidentiality and security of our users' machines is of utmost
96 importance to us. Any security concerns should be addressed to
97 security@g.o or alternatively, you may file a bug at
98 https://bugs.gentoo.org.
99
100 License
101 =======
102
103 Copyright 2020 Gentoo Foundation, Inc; referenced text
104 belongs to its owner(s).
105
106 The contents of this document are licensed under the
107 Creative Commons - Attribution / Share Alike license.
108
109 https://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
OpenPGP_signature.asc application/pgp-signature
Report Message
Find on MARC Find on Google Groups