maintainer-feedback requested: [Bug 274266] x11/libX11: update vulnerable port to 1.8.7
| Newsgroups | gmane.os.freebsd.devel.x11 |
|---|---|
| Message-ID | <[email protected]/bugzilla/> |
Bugzilla Automation <[email protected]> has asked freebsd-x11 (Nobody) <[email protected]> for maintainer-feedback: Bug 274266: x11/libX11: update vulnerable port to 1.8.7 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=274266 --- Description --- X11 has published a security bulletin [1] that exposes the following CVEs in our x11/libX11 version 1.8.6: CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms() CVE-2023-43786: stack exhaustion from infinite recursion in PutSubImage() CVE-2023-43787: Integer overflow in XCreateImage() leading to a heap overflow See changelog for a full list of changes in the release [2]. The attached patch bumps the Makefile, distinfo and updates the pkg-plist according to man pages reorganization. See also related report #274265 regarding x11/libXpm. 1. https://lists.x.org/archives/xorg/2023-October/061506.html 2. https://gitlab.freedesktop.org/xorg/lib/libx11/-/compare/libX11-1.8.6...libX11- 1.8.7