Please bump to 1.7.1.
Missing request length checks in libX11
XLookupColor() and other X libraries function lack proper validation
of the length of their string parameters. If those parameters can be
controlled by an external application (for instance a color name that
can be emitted via a terminal control sequence) it can lead to the
emission of extra X protocol requests to the X server.
A patch for XLookupColor() and other potentially vulnerable functions
has been committed to libX11. libX11 1.7.1 will be released shortly
and contains a fix for this issue.
Reject string longer than USHRT_MAX before sending them on the wire
XTerm version 367 contains extra validation for the length of color
names passed to XLookupColor() from terminal control sequences. XTerm
version 366 and earlier are vulnerable.
Tests conducted by Roman Fiedler on other terminal emulator
applications have not found other cases of passing un-checked color
names to XLookupColor().
This vulnerability has been discovered by Roman Fiedler from
Unparalleled IT Services e.U.
The bug has been referenced in the following commit(s):
Author: Piotr Karbowski <firstname.lastname@example.org>
AuthorDate: 2021-05-18 16:47:15 +0000
Commit: Piotr Karbowski <email@example.com>
CommitDate: 2021-05-18 16:47:15 +0000
x11-libs/libX11: 1.7.1 version bump.
Signed-off-by: Piotr Karbowski <firstname.lastname@example.org>
x11-libs/libX11/Manifest | 1 +
x11-libs/libX11/libX11-1.7.1.ebuild | 39 +++++++++++++++++++++++++++++++++++++
2 files changed, 40 insertions(+)
New GLSA request filed.
This issue was resolved and addressed in
GLSA 202105-16 at https://security.gentoo.org/glsa/202105-16
by GLSA coordinator Thomas Deutschmann (whissi).
Re-opening for remaining architectures.
all arches done