[X font server] integer overflow and heap corruption vulnerability

[disabled.user]

Binary package hint: xfs

References:
[1] http://lists.freedesktop.org/archives/xorg-announce/2007-October/000416.html
[2] http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=602

Affected versions:
According to [1], all prior to xfs 1.0.5

Short summary [from [1]:
"Several vulnerabilities have been identified in xfs, the X font
server. The QueryXBitmaps and QueryXExtents protocol requests suffer
from lack of validation of their 'length' parameters.
[...]
These vulnerabilities can lead to code execution in the font
server. On most modern systems, the font server is accessible only for
local clients and runs with reduced privileges. But on some systems it
may still be accessible from remote clients and possibly running with
root privileges, creating an opportunity for remote privilege
escalation."

Patch for xfs 1.0.4 (included in X11R7.3):
ftp://ftp.freedesktop.org/pub/X11R7.3/patches/xorg-xfs-1.0.4-query.diff

The patch could be added to Gutsy before release; although, xfs is part of universe.

[disabled.user (disabled.user-deactivatedaccount)]

Hmm, sorry, wanted to attach the patch, but the link gives a "550 Failed to change directory.".

[Bryce Harrington (bryce)]

Thanks, I've applied the patch and uploaded to universe.

[Bryce Harrington (bryce)]

xfs (1:1.0.4-2ubuntu1) gutsy; urgency=low

  * CVE-2007-4568: Added debian/patches/100_cve_2007_4568_QueryXBits.patch
    to fix several vulnerabilities with QueryXBitmaps and QueryXExtents
    protocol requests. (Closes LP: #148940)
  * debian/control: Set maintainer to Ubuntu

 -- Bryce Harrington <email address hidden> Thu, 04 Oct 2007 15:18:29 -0700

[disabled.user (disabled.user-deactivatedaccount)]

Thanks for the quick response. If a backported fix could be applied to the stable releases, it would be very nice, too.

[Bryce Harrington (bryce)]

Attaching the patch for the convenience of anyone wishing to backport it.

[Hew (hew)]

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

[LumpyCustard (orangelumpycustard)]

Please close for Feisty as Won't Fix? This goes for all the other Feisty bugs.

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.