according to a posting on oss-security [1]: X.Org has just release libXfont 1.5.4 and libXfont2 2.0.3 which contain the following security fix: Author: Michal Srb <msrb@suse.com> AuthorDate: Thu Oct 26 09:48:13 2017 +0200 Commit: Matthieu Herrb <matthieu@herrb.eu> CommitDate: Sat Nov 25 11:46:50 2017 +0100 Open files with O_NOFOLLOW. (CVE-2017-16611) A non-privileged X client can instruct X server running under root to open any file by creating own directory with "fonts.dir", "fonts.alias" or any font file being a symbolic link to any other file in the system. X server will then open it. This can be issue with special files such as /dev/watchdog. [1] http://openwall.com/lists/oss-security/2017/11/28/7 Reproducible: Always
Thank you Ian. @maintainters(s): after bump, please call for stabilization when ready, thank you. Gentoo Security Padawan (jmbailey/mbailey_j)
Now in tree. Please proceed with stabilization.
amd64 stable
x86 stable
sparc stable (thanks to Rolf Eike Beer)
Stable on alpha.
hppa/ia64/ppc/ppc64 stable
arm stable, all arches done.
Thank you A/Ts, @maintainters, please cleanup.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=679466474ee4f6448fa2a8b706aef63c3d321e8d commit 679466474ee4f6448fa2a8b706aef63c3d321e8d Author: Mart Raudsepp <leio@gentoo.org> AuthorDate: 2018-01-05 15:25:21 +0000 Commit: Mart Raudsepp <leio@gentoo.org> CommitDate: 2018-01-05 15:29:59 +0000 x11-libs/libXfont2: security cleanup Bug: https://bugs.gentoo.org/639064 Package-Manager: Portage-2.3.19, Repoman-2.3.6 x11-libs/libXfont2/Manifest | 1 - x11-libs/libXfont2/libXfont2-2.0.2.ebuild | 33 ------------------------------- 2 files changed, 34 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4cd874980bf4301152a5c9a0bca844c1d3af5a94 commit 4cd874980bf4301152a5c9a0bca844c1d3af5a94 Author: Mart Raudsepp <leio@gentoo.org> AuthorDate: 2018-01-05 15:19:57 +0000 Commit: Mart Raudsepp <leio@gentoo.org> CommitDate: 2018-01-05 15:29:50 +0000 x11-libs/libXfont: security cleanup Bug: https://bugs.gentoo.org/639064 Package-Manager: Portage-2.3.19, Repoman-2.3.6 x11-libs/libXfont/Manifest | 1 - x11-libs/libXfont/libXfont-1.5.3.ebuild | 34 --------------------------------- 2 files changed, 35 deletions(-)}
New GLSA request filed. Gentoo Security Padawan (Jmbailey/mbailey_j)
This issue was resolved and addressed in GLSA 201801-10 at https://security.gentoo.org/glsa/201801-10 by GLSA coordinator Thomas Deutschmann (whissi).
