nx-libs/nx-X11/programs/Xserver/os, branch pr/render-cleanup

imake cleanup: Drop references to X11 build-logic that is not present in nx-X11.

2015-04-28T03:09:09+00:00

library clean-up: Don't build and link libXfont.a anymore. Use system's libXfont shared library and link dynamically.

2015-04-22T04:22:37+00:00

imake cleanup: Drop all references to XprtServer and BuildXprint*.

2015-04-04T08:59:50+00:00

dix: integer overflow in GetHosts() [CVE-2014-8092 2/4]

2015-02-16T04:58:21+00:00

GetHosts() iterates over all the hosts it has in memory, and copies them to a buffer. The buffer length is calculated by iterating over all the hosts and adding up all of their combined length. There is a potential integer overflow, if there are lots and lots of hosts (with a combined length of > ~4 gig). This should be possible by repeatedly calling ProcChangeHosts() on 64bit machines with enough memory. This patch caps the list at 1mb, because multi-megabyte hostname lists for X access control are insane. v2: backport to nx-libs 3.6.x (Mike DePaulo) v3: human-readable version of "1 MB" (Mihai Moldovan) Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith Reviewed-by: Peter Hutterer Conflicts: os/access.c

Revert "dix: integer overflow in GetHosts() [CVE-2014-8092 2/4]"

2015-02-16T04:55:23+00:00

This reverts commit d4c76981f7fddb364166464c571ed8d3de3086cd.

dix: integer overflow in GetHosts() [CVE-2014-8092 2/4]

2015-02-14T15:14:31+00:00

GetHosts() iterates over all the hosts it has in memory, and copies them to a buffer. The buffer length is calculated by iterating over all the hosts and adding up all of their combined length. There is a potential integer overflow, if there are lots and lots of hosts (with a combined length of > ~4 gig). This should be possible by repeatedly calling ProcChangeHosts() on 64bit machines with enough memory. This patch caps the list at 1mb, because multi-megabyte hostname lists for X access control are insane. v2: backport to nx-libs 3.6.x (Mike DePaulo) Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith Reviewed-by: Peter Hutterer Conflicts: os/access.c

unchecked malloc may allow unauthed client to crash Xserver [CVE-2014-8091]

2015-02-14T15:14:31+00:00

authdes_ezdecode() calls malloc() using a length provided by the connection handshake sent by a newly connected client in order to authenticate to the server, so should be treated as untrusted. It didn't check if malloc() failed before writing to the newly allocated buffer, so could lead to a server crash if the server fails to allocate memory (up to UINT16_MAX bytes, since the len field is a CARD16 in the X protocol). Reported-by: Ilja Van Sprundel Signed-off-by: Alan Coopersmith Reviewed-by: Peter Hutterer Conflicts: os/rpcauth.c

Fix CVE-2011-4028: File disclosure vulnerability. upstream xorg/xserver commit 6ba44b91e37622ef8c146d8f2ac92d708a18ed34

2015-02-14T15:14:31+00:00

use O_NOFOLLOW to open the existing lock file, so symbolic links aren't followed, thus avoid revealing if it point to an existing file.

Unbrand NX Agent Startup Screen / Brand X2Go Agent Startup Screen (999_nxagent_unbrand-nxagent-brand-x2goagent.full.patch).

2015-02-13T12:57:39+00:00

When launched with NX Agent flavour, the startup screen gets unbranded by this patch (the !M logo does not get shown). When launched with X2Go Agent flavour, the startup screen gets branded with the X2GO logo.

Be compliant with POS36-C: Observe correct revocation order while relinquishing privileges (602_nx-X11_initgroups.full.patch).

2015-02-13T12:32:17+00:00

The Fedora review of NX (redistributed) caught the following rpmlint issue: This executable is calling setuid and setgid without setgroups or initgroups. There is a high probability this mean it didn't relinquish all groups, and this would be a potential security issue to be fixed. Seek POS36-C on the web for details about the problem. Ref POS36-C: https://www.securecoding.cert.org/confluence/display/seccode/POS36-C.+Observe+correct+revocation+order+while+relinquishing+privileges This patch adds initgroups() calls to the code to initialize the supplemental group list.