{"schema_version": "1.3.1", "id": "RLSA-2021:1804", "modified": "2023-02-02T13:20:15.184959Z", "published": "2021-05-18T06:07:47Z", "related": ["CVE-2020-14344", "CVE-2020-14345", "CVE-2020-14346", "CVE-2020-14347", "CVE-2020-14360", "CVE-2020-14361", "CVE-2020-14362", "CVE-2020-14363", "CVE-2020-25712"], "summary": "Moderate: userspace graphics, xorg-x11, and mesa security, bug fix, and enhancement update", "details": "X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.\n\nMesa provides a 3D graphics API that is compatible with Open Graphics Library (OpenGL). It also provides hardware-accelerated drivers for many popular graphics chips.\n\nThe following packages have been upgraded to a later upstream version: egl-wayland (1.1.5), libdrm (2.4.103), libglvnd (1.3.2), libinput (1.16.3), libwacom (1.6), mesa (20.3.3), xorg-x11-server (1.20.10). (BZ#1878160, BZ#1886648, BZ#1887654, BZ#1887655)\n\nSecurity Fix(es):\n\n* xorg-x11-server: Out-of-bounds access in XkbSetNames function (CVE-2020-14345)\n\n* xorg-x11-server: Integer underflow in the X input extension protocol (CVE-2020-14346)\n\n* xorg-x11-server: Out-of-bounds access in XkbSetMap function (CVE-2020-14360)\n\n* xorg-x11-server: XkbSelectEvents integer underflow privilege escalation vulnerability (CVE-2020-14361)\n\n* xorg-x11-server: XRecordRegisterClients integer underflow privilege escalation vulnerability (CVE-2020-14362)\n\n* libX11: Integer overflow leads to double free in locale handling (CVE-2020-14363)\n\n* xorg-x11-server: XkbSetDeviceInfo heap-based buffer overflow privilege escalation vulnerability (CVE-2020-25712)\n\n* libX11: Heap overflow in the X input method client (CVE-2020-14344)\n\n* xorg-x11-server: Leak of uninitialized heap memory from the X server to clients in AllocatePixmap of dix/pixmap.c (CVE-2020-14347)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.", "severity": [{"type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}], "affected": [{"package": {"ecosystem": "Rocky Linux:8", "name": "egl-wayland", "purl": "pkg:rpm/rocky-linux/egl-wayland?distro=rocky-linux-8-4-legacy&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:1.1.5-3.el8"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "libdrm", "purl": "pkg:rpm/rocky-linux/libdrm?distro=rocky-linux-8-4-legacy&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:2.4.103-1.el8"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "libglvnd", "purl": "pkg:rpm/rocky-linux/libglvnd?distro=rocky-linux-8-4-legacy&epoch=1"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "1:1.3.2-1.el8"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "libinput", "purl": "pkg:rpm/rocky-linux/libinput?distro=rocky-linux-8-4-legacy&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:1.16.3-1.el8"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "libwacom", "purl": "pkg:rpm/rocky-linux/libwacom?distro=rocky-linux-8-4-legacy&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:1.6-2.el8"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "libX11", "purl": "pkg:rpm/rocky-linux/libX11?distro=rocky-linux-8-4-legacy&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:1.6.8-4.el8"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "mesa", "purl": "pkg:rpm/rocky-linux/mesa?distro=rocky-linux-8-4-legacy&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:20.3.3-2.el8"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "xorg-x11-drivers", "purl": "pkg:rpm/rocky-linux/xorg-x11-drivers?distro=rocky-linux-8&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:7.7-30.el8"}], "database_specific": {"yum_repository": "AppStream"}}]}, {"package": {"ecosystem": "Rocky Linux:8", "name": "xorg-x11-server", "purl": "pkg:rpm/rocky-linux/xorg-x11-server?distro=rocky-linux-8-4-legacy&epoch=0"}, "ranges": [{"type": "ECOSYSTEM", "events": [{"introduced": "0"}, {"fixed": "0:1.20.10-1.el8"}], "database_specific": {"yum_repository": "AppStream"}}]}], "references": [{"type": "ADVISORY", "url": "https://errata.rockylinux.org/RLSA-2021:1804"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826141"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1854920"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856738"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1862241"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1862246"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1862255"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1862258"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1863142"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869139"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869142"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869144"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1872473"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1878160"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1886644"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1886648"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887276"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887654"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1887655"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1891871"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1896442"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1897439"}, {"type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914411"}], "credits": [{"name": "Rocky Enterprise Software Foundation"}, {"name": "Red Hat"}]}