xorg/xorg-server
Fredrik Rinnestam d139c53819 [notify] xorg-server: 1.20.10. Fixes for CVE-2020-14360, CVE-2020-25712
Multiple input validation failures in X server XKB extension
============================================================

These issues can lead to privileges elevations for authorized clients
on systems where the X server is running privileged.

* CVE-2020-14360 / ZDI CAN 11572 XkbSetMap Out-Of-Bounds Access

Insufficient checks on the lengths of the XkbSetMap request can lead to
out of bounds memory accesses in the X server.

* CVE-2020-25712 / ZDI-CAN-11839 XkbSetDeviceInfo Heap-based Buffer Overflow

Insufficient checks on input of the XkbSetDeviceInfo request can lead
to a buffer overflow on the head in the X server.
2020-12-01 19:02:53 +01:00
..
.footprint xorg-server: updated to 1.20.0 2018-05-10 20:39:25 +02:00
.signature [notify] xorg-server: 1.20.10. Fixes for CVE-2020-14360, CVE-2020-25712 2020-12-01 19:02:53 +01:00
Pkgfile [notify] xorg-server: 1.20.10. Fixes for CVE-2020-14360, CVE-2020-25712 2020-12-01 19:02:53 +01:00
README xorg-server: README improve commands again 2015-04-18 23:37:56 +10:00

WARNING:

  If you fail to rebuild input and video packages for xorg-server
  on major ABI changes, eg. 1.16.0 -> 1.17.0. You will end up with
  no mouse or keyboard and possibly no direct 3D acceleration for video.

  If you do happen to forget and have sys-rq enabled in your kernel
  you can do a safe reboot with holding down Alt + SysRq, and typing the
  following sequence in order, pausing for several seconds between each key:

  reisub

PRE-INSTALL

	xorg-server 1.16 new dependency libepoxy
	xorg-server 1.16 removed dependency xorg-glamor-egl
	xorg-server 1.17 new dependency xorg-xcb-util-keysyms
	xorg-server 1.17 removed dependency xorg-xf86-video-modesetting

	The current version of xorg-server needs these packages sorted out before 
	a prt-get sysup from crux 3.1 release is done.

prt-get remove xorg-xf86-video-modesetting xorg-glamor-egl
prt-get depinst libepoxy xorg-xcb-util-keysyms

POST-INSTALL

  After upgrading xorg-server, from major versions rebuild video
  and input packages:

  NOTE: This only applies on ABI changes between major versions
  eg, 1.16.0 -> 1.17.0.

prt-get update -fr $(prt-get listinst --regex '^xorg-xf86-(input|video)|^mesa3d')

  If you use nvidia you also need to do this:

gl-select use xorg && gl-select use nvidia