X.Org Foundation Security Advisory

                     For The X Window System 
               
                      17 November 2004

            - - - - - - - - - - - - - - - - - - - - -

Brookline MA, November 17, 2004 - The X.Org Foundation today announced
the release of a patch for the X Window System, which addresses the 
security vulnerability first announced on September 15, 2004, with 
the release of source patch CAN-2004-0687-0688.patch.

X.Org was made aware of additional security vulnerability in libXpm, the X 
Pixmap library, which is shipped as part of the X Window System. The 
affected library is used in many popular application for image viewing and 
manipulation. This library was subject of recent security advisories 
(CAN-2004-0687 and CAN-2004-0688).
1. Affected versions

All X.Org release up to and including R6.8.1 are vulnerable. Products like 
XFree86, lesstif and OpenMotif, which include libXpm are likely to be 
affected. 


2. Description

libXpm is a library for manipulating pixmaps used by the X Window
System.  After the release of the X11R6.8.1 security release, a more
extensive security audit was made. 

Several integer overflows and out-of-bounds memory accesses have been
identified and fixed, a path traversal has been fixed and shell command 
execution has been made more secure. This new fix also addresses possible 
endless loops and memory leaks. These vulnerabilities may allow an 
application linking against libXpm to crash, to become unusable, or to 
execute other code of a user running an application linked against libXpm.

3. CVE Information

The Common Vulnerabilities and Exposures (CVE) project has assigned
the name CAN-2004-0914 to these issues. This is a candidate for
inclusion in the CVE list (http://cve.mitre.org), which standardizes
names for security problems. You may check: 
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0914
 

4. Available Patch.

A source patch is available for:
  X.Org Release 6.8.0 under:
     http://www.x.org/pub/X11R6.8.0/patches/xorg-680-CAN-2004-0914.patch
  and X.Org Release 6.8.1 under:
     http://www.x.org/pub/X11R6.8.1/patches/xorg-681-CAN-2004-0914.patch
and from X.Org mirror sites world-wide.

5. Acknowledgments

The X.Org Foundation would like to thank Petr Mladek for identifying the
vulnerabilities and providing a patch, and Thomas Biege for systematically 
reviewing the libXpm code and fixing additional possible vulnerabilities. 
The X.Org Foundation would also thank Matthieu Herrb and Jacques A. Vidrine
for their help in auditing the code, reviewing the patch and suggesting 
additional fixes.