Skip to navigation

Security Advisory XFree86 security update

Advisory: RHSA-2003:289-07
Type: Security Advisory
Severity: Important
Issued on: 2003-11-12
Last updated on: 2003-11-12
Affected Products: Red Hat Enterprise Linux AS (v. 2.1)
Red Hat Enterprise Linux ES (v. 2.1)
Red Hat Enterprise Linux WS (v. 2.1)
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor
CVEs (cve.mitre.org): CVE-2003-0690
CVE-2003-0730

Details

Updated XFree86 packages provide security fixes to font libraries and XDM.

XFree86 is an implementation of the X Window System providing the core
graphical user interface and video drivers. XDM is the X display manager.

Multiple integer overflows in the transfer and enumeration of font
libraries in XFree86 allow local or remote attackers to cause a denial of
service or execute arbitrary code via heap-based and stack-based buffer
overflow attacks. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2003-0730 to this issue.

The risk to users from this vulnerability is limited because only clients
can be affected by these bugs, however in some (non-default)
configurations, both xfs and the X Server can act as clients
to remote font servers.

XDM does not verify whether the pam_setcred function call succeeds, which
may allow attackers to gain root privileges by triggering error conditions
within PAM modules, as demonstrated in certain configurations of the
pam_krb5 module. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2003-0690 to this issue.

Users are advised to upgrade to these updated XFree86 4.1.0 packages, which
contain backported security patches and are not vulnerable to these issues.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

If up2date fails to connect to Red Hat Network due to SSL Certificate
Errors, you need to install a version of the up2date client with an updated
certificate. The latest version of up2date is available from the Red Hat
FTP site and may also be downloaded directly from the RHN website:

https://rhn.redhat.com/help/latest-up2date.pxt

Updated packages

Red Hat Enterprise Linux AS (v. 2.1)

SRPMS:
XFree86-4.1.0-50.EL.src.rpm
File outdated by:  RHSA-2008:0512
    MD5: d51efc662e065466defaab1b8516d272
 
IA-32:
XFree86-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 3a52e2fef91ae292a4a9adac0215a57c
XFree86-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 1f2ed3cfd0eb6fc125523f0aa0ad8c08
XFree86-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 8d6cbe07759a21fdb053c756524f0e25
XFree86-ISO8859-15-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 4c9aa03d4bf0b4a640a671a9466dfec3
XFree86-ISO8859-15-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: f457007237be4861920c4633d1e9fc21
XFree86-ISO8859-2-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 857ba41d0b2cb38045697d21f9f9ad90
XFree86-ISO8859-2-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: dd28b03b6de76e769a247710883459e9
XFree86-ISO8859-9-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 09e25935e859cfbabb9c122016006321
XFree86-ISO8859-9-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 14e55b18eb8ee39624f218382c95858c
XFree86-Xnest-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: b1e6c9d77422d592aa39b95d84cf1f58
XFree86-Xvfb-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: bba237f33e2da9e2a57575b7f143afe1
XFree86-cyrillic-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: b646f829ac9715991224478135062e05
XFree86-devel-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 3c76690ae56baf809c7216fd05bd94ad
XFree86-doc-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 45f371b5e0682be40bbda61db94bae77
XFree86-libs-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 99b8886561716cf799182b57deed646e
XFree86-tools-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 36d126df15385635213eb289f1c7af39
XFree86-twm-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 326f3b41fb50af17019b03e9b63de183
XFree86-xdm-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 86691dda028a6755a154884b588eba8c
XFree86-xf86cfg-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 2bce51be061de8c33c0decb33126ad01
XFree86-xfs-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: a4093a2f79a6227032fe3c65a580072d
 
IA-64:
XFree86-100dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 0ce82f584a48e261510c4709f8ec39d9
XFree86-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 979a94e5e4b982dbd8f22c5e8dde9be0
XFree86-75dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: d16027ca5abbdc2ef20c521ff1e0a1cc
XFree86-ISO8859-15-100dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 2f8c74e974e21742aaec9aeed936f052
XFree86-ISO8859-15-75dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 6b77c97d45970f3aff35e36eefd906c0
XFree86-ISO8859-2-100dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 888cf76f93d45c07aff6c1cae578f502
XFree86-ISO8859-2-75dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 6d69d1d5e716016da2e0d84b43e20e83
XFree86-ISO8859-9-100dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: b70405d457a97c67085bff6280dd588c
XFree86-ISO8859-9-75dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 460c2f90822af2745d486ea5bab8bbf7
XFree86-Xnest-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: fe76770c5398848d8040202e15b3bb39
XFree86-Xvfb-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 7c2ebf4bfe700be4f7094bdb3fc724ee
XFree86-cyrillic-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 72f4dfb7e91cd864e73921a261c49fd5
XFree86-devel-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: c9d3e4030f40c9abc50693923c6c7a5e
XFree86-doc-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 5e717a8e0dc33961415fbe07cbd59c2c
XFree86-libs-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: d85960e0dc872e86dd8a1829fbbfe30f
XFree86-tools-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: ba1b8f0456261dc132be43e1c899d791
XFree86-twm-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: e549e032ca1512f1b3e4edd1fd9143e0
XFree86-xdm-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 40fcc9b740d55075bc8947c8acc272b5
XFree86-xfs-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: d4c7392aca151d6298c101e4f2ae4c50
 
Red Hat Enterprise Linux ES (v. 2.1)

SRPMS:
XFree86-4.1.0-50.EL.src.rpm
File outdated by:  RHSA-2008:0512
    MD5: d51efc662e065466defaab1b8516d272
 
IA-32:
XFree86-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 3a52e2fef91ae292a4a9adac0215a57c
XFree86-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 1f2ed3cfd0eb6fc125523f0aa0ad8c08
XFree86-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 8d6cbe07759a21fdb053c756524f0e25
XFree86-ISO8859-15-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 4c9aa03d4bf0b4a640a671a9466dfec3
XFree86-ISO8859-15-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: f457007237be4861920c4633d1e9fc21
XFree86-ISO8859-2-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 857ba41d0b2cb38045697d21f9f9ad90
XFree86-ISO8859-2-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: dd28b03b6de76e769a247710883459e9
XFree86-ISO8859-9-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 09e25935e859cfbabb9c122016006321
XFree86-ISO8859-9-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 14e55b18eb8ee39624f218382c95858c
XFree86-Xnest-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: b1e6c9d77422d592aa39b95d84cf1f58
XFree86-Xvfb-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: bba237f33e2da9e2a57575b7f143afe1
XFree86-cyrillic-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: b646f829ac9715991224478135062e05
XFree86-devel-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 3c76690ae56baf809c7216fd05bd94ad
XFree86-doc-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 45f371b5e0682be40bbda61db94bae77
XFree86-libs-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 99b8886561716cf799182b57deed646e
XFree86-tools-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 36d126df15385635213eb289f1c7af39
XFree86-twm-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 326f3b41fb50af17019b03e9b63de183
XFree86-xdm-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 86691dda028a6755a154884b588eba8c
XFree86-xf86cfg-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 2bce51be061de8c33c0decb33126ad01
XFree86-xfs-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: a4093a2f79a6227032fe3c65a580072d
 
Red Hat Enterprise Linux WS (v. 2.1)

SRPMS:
XFree86-4.1.0-50.EL.src.rpm
File outdated by:  RHSA-2008:0512
    MD5: d51efc662e065466defaab1b8516d272
 
IA-32:
XFree86-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 3a52e2fef91ae292a4a9adac0215a57c
XFree86-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 1f2ed3cfd0eb6fc125523f0aa0ad8c08
XFree86-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 8d6cbe07759a21fdb053c756524f0e25
XFree86-ISO8859-15-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 4c9aa03d4bf0b4a640a671a9466dfec3
XFree86-ISO8859-15-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: f457007237be4861920c4633d1e9fc21
XFree86-ISO8859-2-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 857ba41d0b2cb38045697d21f9f9ad90
XFree86-ISO8859-2-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: dd28b03b6de76e769a247710883459e9
XFree86-ISO8859-9-100dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 09e25935e859cfbabb9c122016006321
XFree86-ISO8859-9-75dpi-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 14e55b18eb8ee39624f218382c95858c
XFree86-Xnest-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: b1e6c9d77422d592aa39b95d84cf1f58
XFree86-Xvfb-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: bba237f33e2da9e2a57575b7f143afe1
XFree86-cyrillic-fonts-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: b646f829ac9715991224478135062e05
XFree86-devel-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 3c76690ae56baf809c7216fd05bd94ad
XFree86-doc-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 45f371b5e0682be40bbda61db94bae77
XFree86-libs-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 99b8886561716cf799182b57deed646e
XFree86-tools-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 36d126df15385635213eb289f1c7af39
XFree86-twm-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 326f3b41fb50af17019b03e9b63de183
XFree86-xdm-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 86691dda028a6755a154884b588eba8c
XFree86-xf86cfg-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: 2bce51be061de8c33c0decb33126ad01
XFree86-xfs-4.1.0-50.EL.i386.rpm
File outdated by:  RHSA-2008:0512
    MD5: a4093a2f79a6227032fe3c65a580072d
 
Red Hat Linux Advanced Workstation 2.1 for the Itanium Processor

SRPMS:
XFree86-4.1.0-50.EL.src.rpm
File outdated by:  RHSA-2008:0512
    MD5: d51efc662e065466defaab1b8516d272
 
IA-64:
XFree86-100dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 0ce82f584a48e261510c4709f8ec39d9
XFree86-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 979a94e5e4b982dbd8f22c5e8dde9be0
XFree86-75dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: d16027ca5abbdc2ef20c521ff1e0a1cc
XFree86-ISO8859-15-100dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 2f8c74e974e21742aaec9aeed936f052
XFree86-ISO8859-15-75dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 6b77c97d45970f3aff35e36eefd906c0
XFree86-ISO8859-2-100dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 888cf76f93d45c07aff6c1cae578f502
XFree86-ISO8859-2-75dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 6d69d1d5e716016da2e0d84b43e20e83
XFree86-ISO8859-9-100dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: b70405d457a97c67085bff6280dd588c
XFree86-ISO8859-9-75dpi-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 460c2f90822af2745d486ea5bab8bbf7
XFree86-Xnest-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: fe76770c5398848d8040202e15b3bb39
XFree86-Xvfb-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 7c2ebf4bfe700be4f7094bdb3fc724ee
XFree86-cyrillic-fonts-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 72f4dfb7e91cd864e73921a261c49fd5
XFree86-devel-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: c9d3e4030f40c9abc50693923c6c7a5e
XFree86-doc-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 5e717a8e0dc33961415fbe07cbd59c2c
XFree86-libs-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: d85960e0dc872e86dd8a1829fbbfe30f
XFree86-tools-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: ba1b8f0456261dc132be43e1c899d791
XFree86-twm-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: e549e032ca1512f1b3e4edd1fd9143e0
XFree86-xdm-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: 40fcc9b740d55075bc8947c8acc272b5
XFree86-xfs-4.1.0-50.EL.ia64.rpm
File outdated by:  RHSA-2008:0512
    MD5: d4c7392aca151d6298c101e4f2ae4c50
 

Bugs fixed (see bugzilla for more information)

104647 - CAN-2003-0730 font lib XFree86 integer overflows
104648 - CAN-2003-0690 xdm pam_setcred vulnerability


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/