X Window System Client Library Vulnerabilities: Integer Overflow, Buffer Overflow, Stack Overflow

Critical Vulnerability Information: Description: Core Issue: The X Window System client library contains numerous protocol handling issues when processing server responses. These stem from trusting that the server sends valid protocol data without verifying whether such data could cause overflow or other damage. Main Vulnerability Types: 1. Integer Overflow in Memory Size Calculation - Fails to check for integer overflow during memory size calculation, leading to insufficient memory allocation and data being written beyond buffer boundaries. - Affected functions include: XQueryFont(), XListFontsWithInfo(), XGetMotionEvents(), etc. 2. Signed Integer Extension Issue in Memory Size Calculation - Fails to check for signed integer extension issues, causing negative values to be used in memory size calculations when converting smaller integers to larger ones, potentially resulting in insufficient memory allocation and overflow. - Affected functions include: XAllocColorCells(), XkbReadGetDeviceInfoReply(), XListInputDevices(), etc. 3. Buffer Overflow (Unvalidated Lengths or Offsets in Replies) - Does not validate whether the length or index values returned by the server fall within the expected range, leading to writes beyond allocated memory boundaries. - Affected functions include: XGetDeviceButtonMapping(), XQueryDeviceState(), etc. 4. Integer Overflow When Parsing User-Specified Files - During file data processing, fails to validate whether data read calculations overflow, leading to insufficient memory allocation and overflow. 5. Unbounded Recursion When Parsing User-Specified Files - When processing C-style #include directives, recursion depth is unbounded, potentially causing stack overflow. 6. Memory Corruption Due to Unchecked Return Values - Assumes that the pointer returned by XGetWindowProperty() is properly initialized, but when the call fails, the pointer is uninitialized. Using such an uninitialized pointer for reading/writing or passing to functions like free() can lead to memory corruption. Affected Versions: All previous versions are affected, traceable back to their initial introduction. Fixes: Fixed versions and Git commits are provided for remediation. Warning: The order of patches in Git is sensitive to application order and may affect the effectiveness of patches in previously compressed package versions.

Goal Reached Thanks to every supporter — we hit 100%!

X Window System Client Library Vulnerabilities: Integer Overflow, Buffer Overflow, Stack Overflow