cvs commit: ports/x11/linux-XFree86-libs Makefile distinfo.i386

[Jacques A. Vidrine]

On Sat, Mar 06, 2004 at 04:17:23PM -0500, Trevor Johnson wrote:
> Dag-Erling [iso-8859-1] Smørgrav wrote:
> 
> > Trevor Johnson <trevor at FreeBSD.org> writes:
> > >   Log:
> > >   Update to version 4.3.0-2.90.55 due to several security bugs
> > >   (discovered by iDefense and David Dawes) in the parsing of font
> > >   files and the font.alias file which can give root privileges to
> > >   local users.  [...]
> >
> > This is pointless as the bug in question only affects the server.
> 
> I hadn't noticed that--when I glanced at
> <URL:ftp://ftp.xfree86.org/pub/XFree86/4.3.0/fixes/fontfile.diff>, which
> addresses these bugs, it looked like the problem was in the X libraries,
> not the server.
[...]

The bugs *are* in a library (libXfont), but one could only exploit them
for privilege escalation in the server (which has libXfont compiled
internally).

I added linux-XFree86-libs to the VuXML entry describing this
vulnerability
(http://www.vuxml.org/freebsd/3837f462-5d6b-11d8-80e3-0020ed76ef5a.html)
without thinking too much.  Should I remove it?

Cheers,
-- 
Jacques Vidrine / nectar at celabo.org / jvidrine at verio.net / nectar at freebsd.org