oss-security - X.Org libX11 security advisory: August 25, 2020

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 25 Aug 2020 17:36:21 +0200
From: Matthieu Herrb <matthieu@...rb.eu>
To: oss-security@...ts.openwall.com
Subject: X.Org libX11 security advisory: August 25, 2020

Double free in libX11 locale handling code
==========================================

CVE-2020-14363

There is an integer overflow and a double free vulnerability in the way
LibX11 handles locales. The integer overflow is a necessary precursor to
the double free.

Patches
-------

A Patch for this issue has been committed to the libX11 git repository.
libX11 1.6.12 will be released shortly and will include this patch.

https://gitlab.freedesktop.org/xorg/lib/libx11

commit acdaaadcb3d85c61fd43669fc5dddf0f8c3f911d (HEAD -> master)

    Fix an integer overflow in init_om()

    CVE-2020-14363

    This can lead to a double free later, as reported by Jayden Rivers.

Thanks
------

X.Org thanks Jayden Rivers for reporting this issue to our security
team and assisting them in understanding them and providing fixes.

-- 
Matthieu Herrb

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.