d139c53819
Multiple input validation failures in X server XKB extension ============================================================ These issues can lead to privileges elevations for authorized clients on systems where the X server is running privileged. * CVE-2020-14360 / ZDI CAN 11572 XkbSetMap Out-Of-Bounds Access Insufficient checks on the lengths of the XkbSetMap request can lead to out of bounds memory accesses in the X server. * CVE-2020-25712 / ZDI-CAN-11839 XkbSetDeviceInfo Heap-based Buffer Overflow Insufficient checks on input of the XkbSetDeviceInfo request can lead to a buffer overflow on the head in the X server.
WARNING: If you fail to rebuild input and video packages for xorg-server on major ABI changes, eg. 1.16.0 -> 1.17.0. You will end up with no mouse or keyboard and possibly no direct 3D acceleration for video. If you do happen to forget and have sys-rq enabled in your kernel you can do a safe reboot with holding down Alt + SysRq, and typing the following sequence in order, pausing for several seconds between each key: reisub PRE-INSTALL xorg-server 1.16 new dependency libepoxy xorg-server 1.16 removed dependency xorg-glamor-egl xorg-server 1.17 new dependency xorg-xcb-util-keysyms xorg-server 1.17 removed dependency xorg-xf86-video-modesetting The current version of xorg-server needs these packages sorted out before a prt-get sysup from crux 3.1 release is done. prt-get remove xorg-xf86-video-modesetting xorg-glamor-egl prt-get depinst libepoxy xorg-xcb-util-keysyms POST-INSTALL After upgrading xorg-server, from major versions rebuild video and input packages: NOTE: This only applies on ABI changes between major versions eg, 1.16.0 -> 1.17.0. prt-get update -fr $(prt-get listinst --regex '^xorg-xf86-(input|video)|^mesa3d') If you use nvidia you also need to do this: gl-select use xorg && gl-select use nvidia