Skip to navigation

Security Advisory Moderate: xorg-x11-xfs security update

Advisory: RHSA-2007:0520-2
Type: Security Advisory
Severity: Moderate
Issued on: 2007-07-12
Last updated on: 2007-07-12
Affected Products: Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux Desktop (v. 5 client)
CVEs (cve.mitre.org): CVE-2007-3103

Details

Updated X.org packages that address a flaw in the way the X.Org X11 xfs
font server starts are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

The X.Org X11 xfs font server provides a standard mechanism for an X server
to communicate with a font renderer.

A temporary file flaw was found in the way the X.Org X11 xfs font server
startup script executes. A local user could modify the permissions of a
file of their choosing, possibly elevating their local privileges.
(CVE-2007-3103)

Users of the X.org X11 xfs font server should upgrade to these updated
packages, which contain a backported patch and are not vulnerable to this
issue.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Updated packages

Red Hat Enterprise Linux (v. 5 server)

SRPMS:
xorg-x11-xfs-1.0.2-4.src.rpm
File outdated by:  RHBA-2011:0457
    MD5: 7f6d90098c6a752c16894315b85e739e
 
IA-32:
xorg-x11-xfs-1.0.2-4.i386.rpm
File outdated by:  RHBA-2011:0457
    MD5: 94318ae2d5f02439c58541c5a9c34314
xorg-x11-xfs-utils-1.0.2-4.i386.rpm
File outdated by:  RHBA-2011:0457
    MD5: 1e54d7037ede3c1a5476d3ad65b62eb0
 
IA-64:
xorg-x11-xfs-1.0.2-4.ia64.rpm
File outdated by:  RHBA-2011:0457
    MD5: 9657c080a0362243369a9b54f5207851
xorg-x11-xfs-utils-1.0.2-4.ia64.rpm
File outdated by:  RHBA-2011:0457
    MD5: 346da7e5c6d4660d510016d44fabc095
 
PPC:
xorg-x11-xfs-1.0.2-4.ppc.rpm
File outdated by:  RHBA-2011:0457
    MD5: 2a140017df1fefae7828547975f0d48a
xorg-x11-xfs-utils-1.0.2-4.ppc.rpm
File outdated by:  RHBA-2011:0457
    MD5: 703f21661da66e60c38a2356643078f6
 
s390x:
xorg-x11-xfs-1.0.2-4.s390x.rpm
File outdated by:  RHBA-2011:0457
    MD5: faaacf77fde117b6c71afcb60c7c9508
xorg-x11-xfs-utils-1.0.2-4.s390x.rpm
File outdated by:  RHBA-2011:0457
    MD5: 86b097cc09ab2ab9a7687755950b7279
 
x86_64:
xorg-x11-xfs-1.0.2-4.x86_64.rpm
File outdated by:  RHBA-2011:0457
    MD5: 434fb4f47152e671d0c59b9b677295a8
xorg-x11-xfs-utils-1.0.2-4.x86_64.rpm
File outdated by:  RHBA-2011:0457
    MD5: 6cea61c7098202810b812aba74e8610c
 
Red Hat Enterprise Linux Desktop (v. 5 client)

SRPMS:
xorg-x11-xfs-1.0.2-4.src.rpm
File outdated by:  RHBA-2011:0457
    MD5: 7f6d90098c6a752c16894315b85e739e
 
IA-32:
xorg-x11-xfs-1.0.2-4.i386.rpm
File outdated by:  RHBA-2011:0457
    MD5: 94318ae2d5f02439c58541c5a9c34314
xorg-x11-xfs-utils-1.0.2-4.i386.rpm
File outdated by:  RHBA-2011:0457
    MD5: 1e54d7037ede3c1a5476d3ad65b62eb0
 
x86_64:
xorg-x11-xfs-1.0.2-4.x86_64.rpm
File outdated by:  RHBA-2011:0457
    MD5: 434fb4f47152e671d0c59b9b677295a8
xorg-x11-xfs-utils-1.0.2-4.x86_64.rpm
File outdated by:  RHBA-2011:0457
    MD5: 6cea61c7098202810b812aba74e8610c
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

242903 - CVE-2007-3103 init.d xfs script chown race condition vulnerability


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/