Skip to navigation

Security Advisory Updated XFree86 packages provide security and bug fixes

Advisory: RHSA-2003:287-05
Type: Security Advisory
Severity: N/A
Issued on: 2003-11-25
Last updated on: 2003-11-25
Affected Products: Red Hat Linux 7.3
Red Hat Linux 8.0
CVEs (cve.mitre.org): CVE-2003-0690
CVE-2003-0730

Details

Updated XFree86 packages for Red Hat Linux 7.3 and 8.0 provide security
fixes to font libraries and XDM.

XFree86 is an implementation of the X Window System providing the core
graphical user interface and video drivers in Red Hat Linux. XDM is the X
display manager.

Multiple integer overflows in the transfer and enumeration of font
libraries in XFree86 allow local or remote attackers to cause a denial of
service or execute arbitrary code via heap-based and stack-based buffer
overflow attacks. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2003-0730 to this issue.

The risk to users from this vulnerability is limited because only clients
can be affected by these bugs, however in some (non default)
configurations, both xfs and the X Server can act as clients
to remote font servers.

XDM does not verify whether the pam_setcred function call succeeds, which
may allow attackers to gain root privileges by triggering error conditions
within PAM modules, as demonstrated in certain configurations of the
pam_krb5 module. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2003-0690 to this issue.

Users are advised to upgrade to these updated XFree86 4.2.1 packages, which
contain backported security patches and are not vulnerable to these issues.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

If up2date fails to connect to Red Hat Network due to SSL Certificate
Errors, you need to install a version of the up2date client with an updated
certificate. The latest version of up2date is available from the Red Hat
FTP site and may also be downloaded directly from the RHN website:

https://rhn.redhat.com/help/latest-up2date.pxt

Updated packages

Red Hat Linux 7.3

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/XFree86/4.2.1-13.73.23/SRPMS/XFree86-4.2.1-13.73.23.src.rpm
Missing file
    MD5: 6dc1b32efd505aafd4acf61115077e9e
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-100dpi-fonts/4.2.1-13.73.23/i386/XFree86-100dpi-fonts-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: e814707b495c8d0a30adb16daec18c33
ftp://updates.redhat.com/rhn/repository/NULL/XFree86/4.2.1-13.73.23/i386/XFree86-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: b87cfe1e01934b80e7bb7c6e0dc719a9
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-75dpi-fonts/4.2.1-13.73.23/i386/XFree86-75dpi-fonts-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: b1d5c0db0d7a05883c90d1c6ab9d18fb
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-15-100dpi-fonts/4.2.1-13.73.23/i386/XFree86-ISO8859-15-100dpi-fonts-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: f4fd6d9868aacf9dcc48c4c07faf890d
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-15-75dpi-fonts/4.2.1-13.73.23/i386/XFree86-ISO8859-15-75dpi-fonts-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 003a785d80fdfd838d222c96e559e391
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-2-100dpi-fonts/4.2.1-13.73.23/i386/XFree86-ISO8859-2-100dpi-fonts-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: b773184b7b97e93544ca7ae5cd3fbd45
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-2-75dpi-fonts/4.2.1-13.73.23/i386/XFree86-ISO8859-2-75dpi-fonts-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: cc89ae4346639c5f6cdd35e2702ad03d
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-9-100dpi-fonts/4.2.1-13.73.23/i386/XFree86-ISO8859-9-100dpi-fonts-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: ebb3a1937f9f34ed6b7b1f4c09f5ebfb
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-9-75dpi-fonts/4.2.1-13.73.23/i386/XFree86-ISO8859-9-75dpi-fonts-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 57a1058465aaa805655322ba7f18cfda
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-Xnest/4.2.1-13.73.23/i386/XFree86-Xnest-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: d45d6f8cf3cdffa608a7e2ba90729002
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-Xvfb/4.2.1-13.73.23/i386/XFree86-Xvfb-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 0b7b1e2273dabd54123e1f9a9f02398b
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-base-fonts/4.2.1-13.73.23/i386/XFree86-base-fonts-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 3bcb7efa42b5c27a5af605b65c30cf92
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-cyrillic-fonts/4.2.1-13.73.23/i386/XFree86-cyrillic-fonts-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 3ed229277a41413514200c2beedc9aef
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-devel/4.2.1-13.73.23/i386/XFree86-devel-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 4802948ad7fdaf554ff4c49f7e01eb9b
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-doc/4.2.1-13.73.23/i386/XFree86-doc-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 9a6854ffc8209e1ade2c049847778cf7
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-font-utils/4.2.1-13.73.23/i386/XFree86-font-utils-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 27d6b5d5c6e4cd9178cb9f04fde31336
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-libs/4.2.1-13.73.23/i386/XFree86-libs-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 9174c97c5b1eeec77e978be2f0fb4759
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-tools/4.2.1-13.73.23/i386/XFree86-tools-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: bb4ddc7f291cbb2d942924af3a3e382d
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-truetype-fonts/4.2.1-13.73.23/i386/XFree86-truetype-fonts-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 926875650771bf4e35d7d8f9f2b88581
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-twm/4.2.1-13.73.23/i386/XFree86-twm-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: f8e8b836b2fef31e330310b250f235d5
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-xdm/4.2.1-13.73.23/i386/XFree86-xdm-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 3370b7c640c370a5fae7882c19de346d
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-xf86cfg/4.2.1-13.73.23/i386/XFree86-xf86cfg-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: 6b0835732bd88f3e58551208fd88a694
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-xfs/4.2.1-13.73.23/i386/XFree86-xfs-4.2.1-13.73.23.i386.rpm
Missing file
    MD5: e796a4ecba0c8cd577e556bfefd0d1f8
 
Red Hat Linux 8.0

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/XFree86/4.2.1-23/SRPMS/XFree86-4.2.1-23.src.rpm
Missing file
    MD5: 5b23a90a4fbcec116264f987a1fa2fc6
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-100dpi-fonts/4.2.1-23/i386/XFree86-100dpi-fonts-4.2.1-23.i386.rpm
Missing file
    MD5: 83205dd6d709b1cd0c89bc3ac1fbdcf7
ftp://updates.redhat.com/rhn/repository/NULL/XFree86/4.2.1-23/i386/XFree86-4.2.1-23.i386.rpm
Missing file
    MD5: 0d0b76a5b9c918335fcefe9e96e43400
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-75dpi-fonts/4.2.1-23/i386/XFree86-75dpi-fonts-4.2.1-23.i386.rpm
Missing file
    MD5: c0bff3283737f329e52a44987316905a
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-15-100dpi-fonts/4.2.1-23/i386/XFree86-ISO8859-15-100dpi-fonts-4.2.1-23.i386.rpm
Missing file
    MD5: 468f8042474082e887c49d76eec846cc
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-15-75dpi-fonts/4.2.1-23/i386/XFree86-ISO8859-15-75dpi-fonts-4.2.1-23.i386.rpm
Missing file
    MD5: 6800179468ad3937a761e18d5a58e9a6
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-2-100dpi-fonts/4.2.1-23/i386/XFree86-ISO8859-2-100dpi-fonts-4.2.1-23.i386.rpm
Missing file
    MD5: 8cb666742b3603bb1b5f03c6516f583a
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-2-75dpi-fonts/4.2.1-23/i386/XFree86-ISO8859-2-75dpi-fonts-4.2.1-23.i386.rpm
Missing file
    MD5: 2b6c1b0e013e6dc6ace6ce3411034ea5
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-9-100dpi-fonts/4.2.1-23/i386/XFree86-ISO8859-9-100dpi-fonts-4.2.1-23.i386.rpm
Missing file
    MD5: 421ff4186cf4723ee93cb913aa4759ac
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-ISO8859-9-75dpi-fonts/4.2.1-23/i386/XFree86-ISO8859-9-75dpi-fonts-4.2.1-23.i386.rpm
Missing file
    MD5: 3959c4b6b73f544f57adc30930fc33f5
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-Mesa-libGL/4.2.1-23/i386/XFree86-Mesa-libGL-4.2.1-23.i386.rpm
Missing file
    MD5: 89f84c356a1db508a7bf5a676a21a8e8
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-Mesa-libGLU/4.2.1-23/i386/XFree86-Mesa-libGLU-4.2.1-23.i386.rpm
Missing file
    MD5: 41781ae1dd9259db03f0ea88d8a01791
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-Xnest/4.2.1-23/i386/XFree86-Xnest-4.2.1-23.i386.rpm
Missing file
    MD5: 055a156c76ea4064f423b1910137421f
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-Xvfb/4.2.1-23/i386/XFree86-Xvfb-4.2.1-23.i386.rpm
Missing file
    MD5: c1e17db9962f4f94b54dc10d65369102
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-base-fonts/4.2.1-23/i386/XFree86-base-fonts-4.2.1-23.i386.rpm
Missing file
    MD5: 73d13ff4ad503f803e85c21735d4b4fd
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-cyrillic-fonts/4.2.1-23/i386/XFree86-cyrillic-fonts-4.2.1-23.i386.rpm
Missing file
    MD5: a4867e700dcbf2d1626a91e85c52b585
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-devel/4.2.1-23/i386/XFree86-devel-4.2.1-23.i386.rpm
Missing file
    MD5: 845a3a2974ce06fc9df51b578dc1183a
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-doc/4.2.1-23/i386/XFree86-doc-4.2.1-23.i386.rpm
Missing file
    MD5: 03d9603e1941e5b79f8539208b226dda
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-font-utils/4.2.1-23/i386/XFree86-font-utils-4.2.1-23.i386.rpm
Missing file
    MD5: 5128b77c384b1d9bf12829469e7372ca
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-libs/4.2.1-23/i386/XFree86-libs-4.2.1-23.i386.rpm
Missing file
    MD5: a3944d3f49beda3c7f496f7f45e0cc42
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-tools/4.2.1-23/i386/XFree86-tools-4.2.1-23.i386.rpm
Missing file
    MD5: 45a425d5e5df31f284c7e541f7ca1df3
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-truetype-fonts/4.2.1-23/i386/XFree86-truetype-fonts-4.2.1-23.i386.rpm
Missing file
    MD5: 04cacefa0f0a0021a37a90195353ea63
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-twm/4.2.1-23/i386/XFree86-twm-4.2.1-23.i386.rpm
Missing file
    MD5: 70d9a72ac0fb0e21f9fa053cde55c683
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-xauth/4.2.1-23/i386/XFree86-xauth-4.2.1-23.i386.rpm
Missing file
    MD5: 38b1ee5b9a5218e13bde7ac1ecf4ac8b
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-xdm/4.2.1-23/i386/XFree86-xdm-4.2.1-23.i386.rpm
Missing file
    MD5: 22dcddd4c3960a1e6e499627a2255936
ftp://updates.redhat.com/rhn/repository/NULL/XFree86-xfs/4.2.1-23/i386/XFree86-xfs-4.2.1-23.i386.rpm
Missing file
    MD5: c230f65b0a619a10e3331b68855d6c71
 

References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/