From owner-svn-ports-all@FreeBSD.ORG Wed Jan 8 10:42:06 2014 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 1633B7F4; Wed, 8 Jan 2014 10:42:06 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id EA28F19B8; Wed, 8 Jan 2014 10:42:05 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id s08Ag5Bs021090; Wed, 8 Jan 2014 10:42:05 GMT (envelope-from zeising@svn.freebsd.org) Received: (from zeising@localhost) by svn.freebsd.org (8.14.7/8.14.7/Submit) id s08Ag5Hf021085; Wed, 8 Jan 2014 10:42:05 GMT (envelope-from zeising@svn.freebsd.org) Message-Id: <201401081042.s08Ag5Hf021085@svn.freebsd.org> From: Niclas Zeising Date: Wed, 8 Jan 2014 10:42:05 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r339086 - in head: security/vuxml x11-fonts/libXfont X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jan 2014 10:42:06 -0000 Author: zeising Date: Wed Jan 8 10:42:04 2014 New Revision: 339086 URL: http://svnweb.freebsd.org/changeset/ports/339086 Log: Update libXfont to 1.4.7 This is a security fix and it is important to update, since it might lead to a privilege escalation if the X server is run as root (which is the default) Security: CVE-2013-6462 Modified: head/security/vuxml/vuln.xml head/x11-fonts/libXfont/Makefile head/x11-fonts/libXfont/distinfo Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Wed Jan 8 10:22:03 2014 (r339085) +++ head/security/vuxml/vuln.xml Wed Jan 8 10:42:04 2014 (r339086) @@ -51,6 +51,40 @@ Note: Please add new entries to the beg --> + + libXfont -- Stack buffer overflow in parsing of BDF font files in libXfont + + + libXfont + 1.4.7,1 + + + + +

freedesktop.org reports:

+
A BDF font file containing a longer than expected string can cause + a buffer overflow on the stack. Testing in X servers built with + Stack Protector restulted in an immediate crash when reading a + user-proveded specially crafted font.
+
As libXfont is used to read user-specified font files in all X + servers distributed by X.Org, including the Xorg server which is + often run with root privileges or as setuid-root in order to access + hardware, this bug may lead to an unprivileged user acquiring root + privileges in some systems.
+

+ + + + CVE-2013-6462 + http://lists.x.org/archives/xorg-announce/2014-January/002389.html + + + 2013-12-24 + 2014-01-08 + + + openssl -- multiple vulnerabilities Modified: head/x11-fonts/libXfont/Makefile ============================================================================== --- head/x11-fonts/libXfont/Makefile Wed Jan 8 10:22:03 2014 (r339085) +++ head/x11-fonts/libXfont/Makefile Wed Jan 8 10:42:04 2014 (r339086) @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= libXfont -PORTVERSION= 1.4.6 +PORTVERSION= 1.4.7 PORTEPOCH= 1 CATEGORIES= x11-fonts Modified: head/x11-fonts/libXfont/distinfo ============================================================================== --- head/x11-fonts/libXfont/distinfo Wed Jan 8 10:22:03 2014 (r339085) +++ head/x11-fonts/libXfont/distinfo Wed Jan 8 10:42:04 2014 (r339086) @@ -1,2 +1,2 @@ -SHA256 (xorg/lib/libXfont-1.4.6.tar.bz2) = d0cbfe4554dc17ceea413cdad5601d35ed8d05d5b880e60931a8775fd1157e9f -SIZE (xorg/lib/libXfont-1.4.6.tar.bz2) = 489067 +SHA256 (xorg/lib/libXfont-1.4.7.tar.bz2) = d16ea3541835d296b19cfb05d7e64fc62173d8e7eb93284402ec761b951d1543 +SIZE (xorg/lib/libXfont-1.4.7.tar.bz2) = 482851