mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-23 15:54:21 -09:00
1b72e438a7
Fixes the following security issues:
- CVE-2025-49175: A flaw was found in the X Rendering extension's
handling of animated cursors. If a client provides no cursors, the
server assumes at least one is present, leading to an out-of-bounds
read and potential crash.
For more information, see:
- https://nvd.nist.gov/vuln/detail/CVE-2025-49175
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/0885e0b2
- CVE-2025-49176: A flaw was found in the Big Requests extension. The
request length is multiplied by 4 before checking against the maximum
allowed size, potentially causing an integer overflow and bypassing
the size check.
For more information, see:
- https://nvd.nist.gov/vuln/detail/CVE-2025-49176
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/03731b32
- CVE-2025-49177: A flaw was found in the XFIXES extension. The
XFixesSetClientDisconnectMode handler does not validate the request
length, allowing a client to read unintended memory from previous
requests.
For more information, see:
- https://nvd.nist.gov/vuln/detail/CVE-2025-49177
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/ab02fb96
- CVE-2025-49178: A flaw was found in the X server's request handling.
Non-zero 'bytes to ignore' in a client's request can cause the server
to skip processing another client's request, potentially leading to a
denial of service.
For more information, see:
- https://nvd.nist.gov/vuln/detail/CVE-2025-49178
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/d55c54ce
- CVE-2025-49179: A flaw was found in the X Record extension. The
RecordSanityCheckRegisterClients function does not check for an
integer overflow when computing request length, which allows a client
to bypass length checks.
For more information, see:
- https://nvd.nist.gov/vuln/detail/CVE-2025-49179
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/2bde9ca4
- CVE-2025-49180: A flaw was found in the RandR extension, where the
RRChangeProviderProperty function does not properly validate input.
This issue leads to an integer overflow when computing the total size
to allocate.
For more information, see:
- https://nvd.nist.gov/vuln/detail/CVE-2025-49180
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/3c3a4b76
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/0235121c
For more details on the version bump, see:
- Security Advisory https://lists.x.org/archives/xorg/2025-June/062055.html
- 24.1.7 https://lists.x.org/archives/xorg/2025-June/062057.html
- 24.1.8 https://lists.x.org/archives/xorg/2025-June/062066.html
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5d5a4950b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Buildroot is a simple, efficient and easy-to-use tool to generate embedded Linux systems through cross-compilation. The documentation can be found in docs/manual. You can generate a text document with 'make manual-text' and read output/docs/manual/manual.text. Online documentation can be found at http://buildroot.org/docs.html To build and use the buildroot stuff, do the following: 1) run 'make menuconfig' 2) select the target architecture and the packages you wish to compile 3) run 'make' 4) wait while it compiles 5) find the kernel, bootloader, root filesystem, etc. in output/images You do not need to be root to build or run buildroot. Have fun! Buildroot comes with a basic configuration for a number of boards. Run 'make list-defconfigs' to view the list of provided configurations. Please feed suggestions, bug reports, insults, and bribes back to the buildroot mailing list: buildroot@buildroot.org You can also find us on #buildroot on OFTC IRC. If you would like to contribute patches, please read https://buildroot.org/manual.html#submitting-patches