maintainer-feedback requested: [Bug 274266] x11/libX11: update vulnerable port to 1.8.7

[email protected]
Newsgroups gmane.os.freebsd.devel.x11
Message-ID <[email protected]/bugzilla/>
Bugzilla Automation <[email protected]> has asked freebsd-x11 (Nobody)
<[email protected]> for maintainer-feedback:
Bug 274266: x11/libX11: update vulnerable port to 1.8.7
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274266



--- Description ---
X11 has published a security bulletin [1] that exposes the following CVEs in
our x11/libX11 version 1.8.6:

CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()
CVE-2023-43786: stack exhaustion from infinite recursion in PutSubImage()
CVE-2023-43787: Integer overflow in XCreateImage() leading to a heap overflow

See changelog for a full list of changes in the release [2].

The attached patch bumps the Makefile, distinfo and updates the pkg-plist
according to man pages reorganization.

See also related report #274265 regarding x11/libXpm.

1. https://lists.x.org/archives/xorg/2023-October/061506.html
2.
https://gitlab.freedesktop.org/xorg/lib/libx11/-/compare/libX11-1.8.6...libX11-
1.8.7
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.