Red Hat Linux Advisory: XFree86
Jul 02, 2003, 03:52 (0 Talkback[s])
Red Hat Security Advisory
||Updated XFree86 packages provide security and bug fixes
||Red Hat Linux
||CAN-2001-1409 CAN-2002-1472 CAN-2002-0164 CAN-2003-0063
New XFree86 packages for Red Hat Linux 8.0 are now available
which include several security fixes, bug fixes, enhancements, and
[Updated: June 30, 2003]
The XFree86 4.2.1-20 packages which were originally released in
this advisory were accidentally built with debugging info enabled
due to a temporary problem with our build system. Unfortunately,
this problem was not noticed during package testing, and caused the
new XFree86 packages to contain full debug symbol data, resulting
in extremely large packages.
Note that the previously released packages are functional and
should not cause any problems on systems with adequate disk space.
However we are releasing new XFree86 4.2.1-21 packages to both
minimize the download time for people that have not yet updated
XFree86 on their systems, and to minimize the disk space footprint
caused by this issue. Additionally, our testing procedures have
also been updated to automatically catch similar issues in the
Red Hat apologizes for any inconvenience this may have caused
2. Relevant releases/architectures:
Red Hat Linux 8.0 - i386
3. Problem description:
XFree86 is an implementation of the X Window System providing
the core graphical user interface and video drivers in Red Hat
A number of security vulnerabilities have been discovered in
- - Xterm, provided as part of the XFree86 packages, provides an
escape sequence for reporting the current window title. This escape
sequence essentially takes the current title and places it directly
on the command line. An attacker can craft an escape sequence that
sets the victim's Xterm window title to an arbitrary command, and
then reports it to the command line. Since it is not possible to
embed a carriage return into the window title, the attacker would
then have to convince the victim to press Enter for the shell to
process the title as a command, although the attacker could craft
other escape sequences that might convince the victim to do so. The
Common Vulnerabilities and Exposures project (cve.mitre.org/) has assigned the name
CAN-2003-0063 to this issue.
- - It is possible to lock up versions of Xterm by sending an
invalid DEC UDK escape sequence. (CAN-2003-0071)
- - XFree86 4.2.1 also contains an updated fix for CAN-2002-0164,
a vulnerability in the MIT-SHM extension of the X server that
allows local users to read and write arbitrary shared memory. The
original fix did not cover the case where the X server is started
- - The X server was setting the /dev/dri directory permissions
incorrectly, which resulted in the directory being world writable.
It now sets the directory permissions to a safe value.
Driver updates and additions:
- - Savage driver updated to Tim Roberts' latest version
- - Added new "cyrix" driver from Alan Cox, which works much
better on MediaGX hardware.
- - Added new input drivers from Alan Cox for Fujitsu Stylistic
(fpit), Palmax PD1000/PD1100 Input driver (palmax), Union Reality
UR-98 head tracker (ur98)
- - Backported apm driver from XFree86 CVS, DPMS support
enhancements, and a few accel fixes
- - Backported ark driver from XFree86 CVS
- - Backported chips driver from XFree86 CVS, with hardware mouse
cursor and 2D accleration fixes.
- - Backported cirrus i740, siliconmotion, and ark drivers from
Various bug fixes and enhancements:
- - Bug fixes for the RENDER extension and libraries which
- - Various fixes to the Xaw library
- - A long standing problem in the X server has been fixed in
which the mouse, keyboard, or video would hang, or the server to go
into an endless loop whenever the system time was changed backward
while X was running
- - Fixed a bug in both the Radeon and Rage 128 drivers which
caused crashes while using VMware with DGA when DRI is enabled
- - The Matrox "mga" driver had some problems with multihead and
the RENDER extension which have been worked around.
- - fc-cache is now run upon font package installation in all
font directories containing fonts managed by fontconfig/Xft
- - mkfontdir has been modified to force the permissions of the
files it generates to be mode 0644 ensuring they are world readable
independant of umask.
- - Added a new option "ForceLegacyCRT" to the radeon driver to
allow use of legacy VGA monitors which can not be detected
automatically. This option is only safe to use in single-head
setups and may cause serious problems if used with dual-head.
- - xterm session management is now enabled by default, whereas
the stock XFree86 default in 4.2.0/4.2.1 was accidentally disabled
- - Removed and obsoleted the XFree86-xtrap-clients package, and
merged it into the main XFree86 package to simplify packaging
There are various other fixes included which users can review by
examining the RPM package changelog of any of the new XFree86
Users are advised to upgrade to these updated XFree86 4.2.1
packages, which are not vulnerable to the previously mentioned
Before applying this update, make sure all previously released
errata relevant to your system have been applied.
To update all RPMs for your particular architecture, run:
rpm -Fvh [filenames]
where [filenames] is a list of the RPMs you wish to upgrade.
Only those RPMs which are currently installed will be updated.
Those RPMs which are not installed but included in the list will
not be updated. Note that you can also use wildcards (*.rpm) if
your current directory only contains the desired RPMs.
Please note that this update is also available via Red Hat
Network. Many people find this an easier way to apply updates. To
use Red Hat Network, launch the Red Hat Update Agent with the
This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla
for more info):
63509 - mouse event problems after system standby
69978 - Radeon failure with old VGA monitor
72297 - MediaGX 5530 XFree86 failure
73678 - Screen corruption when running full-screen VMware under
75155 - lndir doesn't work with relative symlink
76154 - Mozilla with xft crashes on Red Hat 8.0 (Xrender bug)
77542 - XFree86-truetype-fonts does integrate with
77930 - rhPrintOSKernelString can print stack garbage
78804 - Xutf8LookupString fails in UTF-8 locale if X server lacks
79488 - XKeysymDB is included in XFree86.rpm whereas it should be
83303 - Unresolved DRM symbols in r128 driver (4.2.1)
84036 - xauth can write incomplete .xauth files
88773 - xterm session management is disabled by default in XFree86
6. RPMs required:
Red Hat Linux 8.0:
MD5 sum Package Name
These packages are GPG signed by Red Hat for security. Our key
is available from http://www.redhat.com/security/keys.html
You can verify each package with the following command:
rpm --checksig -v <filename>
If you only wish to verify that each package has not been
corrupted or tampered with, examine only the md5sum with the
The Red Hat security contact is <email@example.com>. More
contact details at http://www.redhat.com/solutions/security/news/contact.html
Copyright 2003 Red Hat, Inc.