From owner-svn-ports-branches@FreeBSD.ORG Wed Jan 8 11:25:16 2014 Return-Path: Delivered-To: svn-ports-branches@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 708FCC5F; Wed, 8 Jan 2014 11:25:16 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 5BCA81E52; Wed, 8 Jan 2014 11:25:16 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id s08BPGYJ039160; Wed, 8 Jan 2014 11:25:16 GMT (envelope-from kwm@svn.freebsd.org) Received: (from kwm@localhost) by svn.freebsd.org (8.14.7/8.14.7/Submit) id s08BPFZJ039154; Wed, 8 Jan 2014 11:25:15 GMT (envelope-from kwm@svn.freebsd.org) Message-Id: <201401081125.s08BPFZJ039154@svn.freebsd.org> From: Koop Mast Date: Wed, 8 Jan 2014 11:25:15 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-branches@freebsd.org Subject: svn commit: r339097 - in branches/2014Q1: security/vuxml x11-fonts/libXfont X-SVN-Group: ports-branches MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-branches@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: SVN commit messages for all the branches of the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 08 Jan 2014 11:25:16 -0000 Author: kwm Date: Wed Jan 8 11:25:15 2014 New Revision: 339097 URL: http://svnweb.freebsd.org/changeset/ports/339097 Log: MFH: r339086 Update libXfont to 1.4.7 This is a security fix and it is important to update, since it might lead to a privilege escalation if the X server is run as root (which is the default) Security: CVE-2013-6462 Approved by: portmgr-lurker (mat) Modified: branches/2014Q1/security/vuxml/vuln.xml branches/2014Q1/x11-fonts/libXfont/Makefile branches/2014Q1/x11-fonts/libXfont/distinfo Directory Properties: branches/2014Q1/ (props changed) Modified: branches/2014Q1/security/vuxml/vuln.xml ============================================================================== --- branches/2014Q1/security/vuxml/vuln.xml Wed Jan 8 11:23:59 2014 (r339096) +++ branches/2014Q1/security/vuxml/vuln.xml Wed Jan 8 11:25:15 2014 (r339097) @@ -51,6 +51,40 @@ Note: Please add new entries to the beg --> + + libXfont -- Stack buffer overflow in parsing of BDF font files in libXfont + + + libXfont + 1.4.7,1 + + + + +

freedesktop.org reports:

+
A BDF font file containing a longer than expected string can cause + a buffer overflow on the stack. Testing in X servers built with + Stack Protector restulted in an immediate crash when reading a + user-proveded specially crafted font.
+
As libXfont is used to read user-specified font files in all X + servers distributed by X.Org, including the Xorg server which is + often run with root privileges or as setuid-root in order to access + hardware, this bug may lead to an unprivileged user acquiring root + privileges in some systems.
+

+ + + + CVE-2013-6462 + http://lists.x.org/archives/xorg-announce/2014-January/002389.html + + + 2013-12-24 + 2014-01-08 + + + openssl -- multiple vulnerabilities Modified: branches/2014Q1/x11-fonts/libXfont/Makefile ============================================================================== --- branches/2014Q1/x11-fonts/libXfont/Makefile Wed Jan 8 11:23:59 2014 (r339096) +++ branches/2014Q1/x11-fonts/libXfont/Makefile Wed Jan 8 11:25:15 2014 (r339097) @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= libXfont -PORTVERSION= 1.4.6 +PORTVERSION= 1.4.7 PORTEPOCH= 1 CATEGORIES= x11-fonts Modified: branches/2014Q1/x11-fonts/libXfont/distinfo ============================================================================== --- branches/2014Q1/x11-fonts/libXfont/distinfo Wed Jan 8 11:23:59 2014 (r339096) +++ branches/2014Q1/x11-fonts/libXfont/distinfo Wed Jan 8 11:25:15 2014 (r339097) @@ -1,2 +1,2 @@ -SHA256 (xorg/lib/libXfont-1.4.6.tar.bz2) = d0cbfe4554dc17ceea413cdad5601d35ed8d05d5b880e60931a8775fd1157e9f -SIZE (xorg/lib/libXfont-1.4.6.tar.bz2) = 489067 +SHA256 (xorg/lib/libXfont-1.4.7.tar.bz2) = d16ea3541835d296b19cfb05d7e64fc62173d8e7eb93284402ec761b951d1543 +SIZE (xorg/lib/libXfont-1.4.7.tar.bz2) = 482851