ESB-2017.2647 - [Ubuntu] xserver-xorg-core: Multiple vulnerabilities 2017-10-19

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.2647
                      X.Org X server vulnerabilities
                              19 October 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           xserver-xorg-core
Publisher:         Ubuntu
Operating System:  Ubuntu
Impact/Access:     Execute Arbitrary Code/Commands -- Existing Account
                   Denial of Service               -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-12187 CVE-2017-12186 CVE-2017-12185
                   CVE-2017-12184 CVE-2017-12183 CVE-2017-12182
                   CVE-2017-12181 CVE-2017-12180 CVE-2017-12179
                   CVE-2017-12178 CVE-2017-12177 CVE-2017-12176

Reference:         ESB-2017.2609

Original Bulletin: 
   http://www.ubuntu.com/usn/usn-3456-1

- --------------------------BEGIN INCLUDED TEXT--------------------

==========================================================================
Ubuntu Security Notice USN-3456-1
October 17, 2017

xorg-server, xorg-server-hwe-16.04, xorg-server-lts-xenial vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- - Ubuntu 17.04
- - Ubuntu 16.04 LTS
- - Ubuntu 14.04 LTS

Summary:

Several security issues were fixed in the X.Org X server.

Software Description:
- - xorg-server: X.Org X11 server
- - xorg-server-hwe-16.04: X.Org X11 server
- - xorg-server-lts-xenial: X.Org X11 server

Details:

It was discovered that the X.Org X server incorrectly handled certain
lengths. An attacker able to connect to an X server, either locally or
remotely, could use these issues to crash the server, or possibly execute
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 17.04:
  xserver-xorg-core               2:1.19.3-1ubuntu1.3

Ubuntu 16.04 LTS:
  xserver-xorg-core               2:1.18.4-0ubuntu0.7
  xserver-xorg-core-hwe-16.04     2:1.19.3-1ubuntu1~16.04.4

Ubuntu 14.04 LTS:
  xserver-xorg-core               2:1.15.1-0ubuntu2.11
  xserver-xorg-core-lts-xenial    2:1.18.3-1ubuntu2.3~trusty4

After a standard system update you need to reboot your computer to make
all the necessary changes.

References:
  https://www.ubuntu.com/usn/usn-3456-1
  CVE-2017-12176, CVE-2017-12177, CVE-2017-12178, CVE-2017-12179,
  CVE-2017-12180, CVE-2017-12181, CVE-2017-12182, CVE-2017-12183,
  CVE-2017-12184, CVE-2017-12185, CVE-2017-12186, CVE-2017-12187

Package Information:
  https://launchpad.net/ubuntu/+source/xorg-server/2:1.19.3-1ubuntu1.3
  https://launchpad.net/ubuntu/+source/xorg-server/2:1.18.4-0ubuntu0.7

  https://launchpad.net/ubuntu/+source/xorg-server-hwe-16.04/2:1.19.3-1ubuntu1~16.04.4
  https://launchpad.net/ubuntu/+source/xorg-server/2:1.15.1-0ubuntu2.11

  https://launchpad.net/ubuntu/+source/xorg-server-lts-xenial/2:1.18.3-1ubuntu2.3~trusty4

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWegpz4x+lLeg9Ub1AQje5w/+JUQxvxVxnfd/zB4TMCs2+qIunllIZPr9
nzXxlbNk08F1fYPNxMlMvlSCJhJ5OuYzJEG/NN3iLgs0yGzLqBVHiPi84vY5GSk2
GLTgTkhqz67ICEkxHe0uLtNNtUcG7MevDzrCVeMjBP9i4hKId3W01H2hz+WZbUz6
Vx0ROu7rBwH2GZpeIrS6rf9GaarYlLEdhjmX0RP54FfzEW4WoOia69sJBh4bkvYy
zKPgkjwSnW5NpqJpPt8zmNfRNVFObi8NtIUEJbmaY8mtTo0OgRev/Yo4ScFL+WWm
tdDTXWVBqj1R2E7BL9iHvO3vJ2ucChmwJicIT9ZxjqwFCNlujY2ya7feKymKOna4
kX10FT/Y0HhgKdUCJuW6RhXZhmth55blqi5rns++y5p7KF9ADuC+3Be6kjdA/9K4
My9nDwCWH8EqPHyF3wgFr3WDvuWfjilxfF049li6Idv1ePJOddxT4WbArDYGPLv2
ijLqZwlui9WccMVOLwECpmD0CSecUYVwPpvFjBmSOOzKsY/Cy2S4C+xJps9NGyT5
pyNXBf2R5vmL+9o4mpt7qUJH257IsFEazqItUu1oSJrW8LJJzH/t0bcO96OAbZ1K
bD1A/mKU/5vExM0gB45EIIUAk4VPmdM4qB3Ys7IqgVvPO0BSy9G6uGu58SP5nxh8
e8RxSDj+Bd0=
=RZmr
-----END PGP SIGNATURE-----

« Back to bulletins