import tigervnc-1.12.0-9.el8_7.3
This commit is contained in:
parent
ac813de0e4
commit
5ca55f1f32
@ -0,0 +1,28 @@
|
|||||||
|
From 774c6bcf33b5c9b94c1ff12895775e77c555decc Mon Sep 17 00:00:00 2001
|
||||||
|
From: Pierre Ossman <ossman@cendio.se>
|
||||||
|
Date: Thu, 9 Feb 2023 11:30:37 +0100
|
||||||
|
Subject: [PATCH] Sanity check when cleaning up keymap changes
|
||||||
|
|
||||||
|
Make sure we don't send a bogus request to the X server in the (common)
|
||||||
|
case that we don't actually have anything to restore.
|
||||||
|
|
||||||
|
(cherry picked from commit 1e3484f2017f038dd5149cd50741feaf39a680e4)
|
||||||
|
---
|
||||||
|
unix/x0vncserver/XDesktop.cxx | 4 ++++
|
||||||
|
1 file changed, 4 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/unix/x0vncserver/XDesktop.cxx b/unix/x0vncserver/XDesktop.cxx
|
||||||
|
index d5c6b2db9..f9c810968 100644
|
||||||
|
--- a/unix/x0vncserver/XDesktop.cxx
|
||||||
|
+++ b/unix/x0vncserver/XDesktop.cxx
|
||||||
|
@@ -481,6 +481,10 @@ void XDesktop::deleteAddedKeysyms(Display* dpy) {
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
+ // Did we actually find something to remove?
|
||||||
|
+ if (highestKeyCode < lowestKeyCode)
|
||||||
|
+ return;
|
||||||
|
+
|
||||||
|
changes.changed |= XkbKeySymsMask;
|
||||||
|
changes.first_key_sym = lowestKeyCode;
|
||||||
|
changes.num_key_syms = highestKeyCode - lowestKeyCode + 1;
|
@ -0,0 +1,42 @@
|
|||||||
|
From 947bd1b3f4a23565bf10879ec41ba06ebe1e1c76 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Olivier Fourdan <ofourdan@redhat.com>
|
||||||
|
Date: Mon, 13 Mar 2023 11:08:47 +0100
|
||||||
|
Subject: [PATCH xserver] composite: Fix use-after-free of the COW
|
||||||
|
|
||||||
|
ZDI-CAN-19866/CVE-2023-1393
|
||||||
|
|
||||||
|
If a client explicitly destroys the compositor overlay window (aka COW),
|
||||||
|
we would leave a dangling pointer to that window in the CompScreen
|
||||||
|
structure, which will trigger a use-after-free later.
|
||||||
|
|
||||||
|
Make sure to clear the CompScreen pointer to the COW when the latter gets
|
||||||
|
destroyed explicitly by the client.
|
||||||
|
|
||||||
|
This vulnerability was discovered by:
|
||||||
|
Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
|
||||||
|
|
||||||
|
Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
|
||||||
|
Reviewed-by: Adam Jackson <ajax@redhat.com>
|
||||||
|
---
|
||||||
|
composite/compwindow.c | 5 +++++
|
||||||
|
1 file changed, 5 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/composite/compwindow.c b/composite/compwindow.c
|
||||||
|
index 4e2494b86..b30da589e 100644
|
||||||
|
--- a/composite/compwindow.c
|
||||||
|
+++ b/composite/compwindow.c
|
||||||
|
@@ -620,6 +620,11 @@ compDestroyWindow(WindowPtr pWin)
|
||||||
|
ret = (*pScreen->DestroyWindow) (pWin);
|
||||||
|
cs->DestroyWindow = pScreen->DestroyWindow;
|
||||||
|
pScreen->DestroyWindow = compDestroyWindow;
|
||||||
|
+
|
||||||
|
+ /* Did we just destroy the overlay window? */
|
||||||
|
+ if (pWin == cs->pOverlayWin)
|
||||||
|
+ cs->pOverlayWin = NULL;
|
||||||
|
+
|
||||||
|
/* compCheckTree (pWin->drawable.pScreen); can't check -- tree isn't good*/
|
||||||
|
return ret;
|
||||||
|
}
|
||||||
|
--
|
||||||
|
2.40.0
|
||||||
|
|
@ -5,7 +5,7 @@
|
|||||||
|
|
||||||
Name: tigervnc
|
Name: tigervnc
|
||||||
Version: 1.12.0
|
Version: 1.12.0
|
||||||
Release: 9%{?dist}.1
|
Release: 9%{?dist}.3
|
||||||
Summary: A TigerVNC remote display system
|
Summary: A TigerVNC remote display system
|
||||||
|
|
||||||
%global _hardened_build 1
|
%global _hardened_build 1
|
||||||
@ -32,6 +32,7 @@ Patch53: tigervnc-vncsession-restore-script-systemd-service.patch
|
|||||||
Patch54: tigervnc-fix-ghost-cursor-in-zaphod-mode.patch
|
Patch54: tigervnc-fix-ghost-cursor-in-zaphod-mode.patch
|
||||||
# https://github.com/TigerVNC/tigervnc/pull/1510
|
# https://github.com/TigerVNC/tigervnc/pull/1510
|
||||||
Patch55: tigervnc-add-new-keycodes-for-unknown-keysyms.patch
|
Patch55: tigervnc-add-new-keycodes-for-unknown-keysyms.patch
|
||||||
|
Patch56: tigervnc-sanity-check-when-cleaning-up-keymap-changes.patch
|
||||||
|
|
||||||
# This is tigervnc-%%{version}/unix/xserver116.patch rebased on the latest xorg
|
# This is tigervnc-%%{version}/unix/xserver116.patch rebased on the latest xorg
|
||||||
Patch100: tigervnc-xserver120.patch
|
Patch100: tigervnc-xserver120.patch
|
||||||
@ -40,6 +41,8 @@ Patch101: 0001-rpath-hack.patch
|
|||||||
|
|
||||||
# CVE-2023-0494 tigervnc: xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
|
# CVE-2023-0494 tigervnc: xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
|
||||||
Patch110: xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
|
Patch110: xorg-x11-server-Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
|
||||||
|
# CVE-2023-1393 tigervnc: xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
|
||||||
|
Patch111: xorg-x11-server-composite-Fix-use-after-free-of-the-COW.patch
|
||||||
|
|
||||||
BuildRequires: gcc-c++
|
BuildRequires: gcc-c++
|
||||||
BuildRequires: libX11-devel, automake, autoconf, libtool, gettext, gettext-autopoint
|
BuildRequires: libX11-devel, automake, autoconf, libtool, gettext, gettext-autopoint
|
||||||
@ -163,6 +166,7 @@ done
|
|||||||
%patch100 -p1 -b .xserver120-rebased
|
%patch100 -p1 -b .xserver120-rebased
|
||||||
%patch101 -p1 -b .rpath
|
%patch101 -p1 -b .rpath
|
||||||
%patch110 -p1 -b .Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
|
%patch110 -p1 -b .Xi-fix-potential-use-after-free-in-DeepCopyPointerCl.patch
|
||||||
|
%patch111 -p1 -b .composite-Fix-use-after-free-of-the-COW
|
||||||
popd
|
popd
|
||||||
|
|
||||||
%patch1 -p1 -b .use-gnome-as-default-session
|
%patch1 -p1 -b .use-gnome-as-default-session
|
||||||
@ -174,6 +178,7 @@ popd
|
|||||||
%patch53 -p1 -b .vncsession-restore-script-systemd-service
|
%patch53 -p1 -b .vncsession-restore-script-systemd-service
|
||||||
%patch54 -p1 -b .fix-ghost-cursor-in-zaphod-mode
|
%patch54 -p1 -b .fix-ghost-cursor-in-zaphod-mode
|
||||||
%patch55 -p1 -b .add-new-keycodes-for-unknown-keysyms
|
%patch55 -p1 -b .add-new-keycodes-for-unknown-keysyms
|
||||||
|
%patch56 -p1 -b .sanity-check-when-cleaning-up-keymap-changes
|
||||||
|
|
||||||
%build
|
%build
|
||||||
%ifarch sparcv9 sparc64 s390 s390x
|
%ifarch sparcv9 sparc64 s390 s390x
|
||||||
@ -328,7 +333,15 @@ fi
|
|||||||
%ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
|
%ghost %verify(not md5 size mtime) %{_sharedstatedir}/selinux/%{selinuxtype}/active/modules/200/%{modulename}
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Mon Feb 06 2023 Jan Grulich <jgrulich@redhat.com> - 1.12.0-9
|
*Mon Mar 27 2023 Jan Grulich <jgrulich@redhat.com> - 1.12.0-9.3
|
||||||
|
- xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege Escalation Vulnerability
|
||||||
|
Resolves: bz#2180304
|
||||||
|
|
||||||
|
* Wed Feb 15 2023 Jan Grulich <jgrulich@redhat.com> - 1.12.0-9.2
|
||||||
|
- Add sanity check when cleaning up keymap changes
|
||||||
|
Resolves: bz#2169962
|
||||||
|
|
||||||
|
* Mon Feb 06 2023 Jan Grulich <jgrulich@redhat.com> - 1.12.0-9.1
|
||||||
- xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
|
- xorg-x11-server: DeepCopyPointerClasses use-after-free leads to privilege elevation
|
||||||
Resolves: bz#2167057
|
Resolves: bz#2167057
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user