Debian alert DLA-3602-1 (libx11)

From:
             
 
Emilio Pozuelo Monfort <pochu@debian.org>
To:
             
 
<debian-lts-announce@lists.debian.org>
Subject:
             
 
[SECURITY] [DLA 3602-1] libx11 security update
Date:
             
 
Thu, 05 Oct 2023 12:39:13 +0200
Message-ID:
             
 
<20231005103913.9AB5F2A0588@andromeda>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3602-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/               Emilio Pozuelo Monfort
October 05, 2023                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : libx11
Version        : 2:1.6.7-1+deb10u4
CVE ID         : CVE-2023-43785 CVE-2023-43786 CVE-2023-43787

Several vulnerabilities were found in libx11, the X11 client-side
library.

CVE-2023-43785

    Gregory James Duck discovered an out of bounds memory access in
    _XkbReadKeySyms, which could result in denial of service.

CVE-2023-43786

    Yair Mizrahi found an infinite recursion in PutSubImage when
    parsing a crafted file, which would result in stack exhaustion
    and denial of service.

CVE-2023-43787

    Yair Mizrahi discovered an integer overflow in XCreateImage
    when parsing crafted input, which would result in a small buffer
    allocation leading into a buffer overflow. This could result
    in denial of service or potentially in arbitrary code execution.

For Debian 10 buster, these problems have been fixed in version
2:1.6.7-1+deb10u4.

We recommend that you upgrade your libx11 packages.

For the detailed security status of libx11 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libx11

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEcJymx+vmJZxd92Q+nUbEiOQ2gwIFAmUekk4ACgkQnUbEiOQ2
gwK1sw//ai6rFAnWS1H7P7YFadvk+nKoF4feKNHOQJHm8iz8N0F5XJdwxMK11wqh
xWsvYwh4pR0TD/LXGilFj/ruG6CjBXbPeQAKm6gJTIogH/yrJwALKmaHU6086Z/Y
eO9jPivkZ7Sg70ju7oHM2yz0c5CFB5S5keR1h1UKGK9d+pEtHNaCRZnVN/exVFbY
ujsXz5wYXuCyIS86TNKpgEeBmoFVQd+2tdatjKV9cPrGttpvuStJd0zAXzIuw1nE
7n+lwwOwq/q1QuKAObcugBW5/7JiV9FjBbBEtnbOejlWhr/XhBiflqy6evykjjnZ
/R0wRrI61iDj/g3N4DZMmlfMezY3e7bx846DlcVtLuPjNP/64vX0DunSANATRKWn
EqbI75sffr1q88tVq4xC82u8Q9mRjfuPj/gFkid0LEznqCGpTUfnre1n58x+v+ck
d7I3hSWFCXfvQ8ZnXet0xd9wG4G4fkic+YT6dSiIqbMi21zrX4NNPKpS4z1flER8
+EYzy3fcLUQWzTAigGWO2XqiE2oWRFlJNsvkm4KQ3A0ziI/9Sqy+iWsypj0D7/uq
qTg7pZRlFaa3zMNIHLu1/T4HsnFQ+73o1Q7EBGCQYlm75qkuSL8pyN4L/tt1A3is
tiKz6V9RXeFG3RGKlI8J9kiiUHEY9dQpZbBDALh3/pixJ6qtm9w=
=qFN9
-----END PGP SIGNATURE-----