-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  xorg server overflow (SSA:2006-123-01)

New xorg and xorg-devel packages are available for Slackware 10.1, 10.2,
and -current to fix a security issue.  A typo in the X render extension
in X.Org 6.8.0 or later allows an X client to crash the server and
possibly to execute arbitrary code as the X server user (typically this
is "root".)

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526

The advisory from X.Org may be found here:

  http://lists.freedesktop.org/archives/xorg/2006-May/015136.html


Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/x11-6.8.2-i486-5.tgz:
  Patched with x11r6.9.0-mitri.diff and recompiled.
  A typo in the X render extension allows an X client to crash the server
  and possibly to execute arbitrary code as the X server user (typically
  this is "root".)
  The CVE entry for this issue may be found here:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526
  The advisory from X.Org may be found here:
    http://lists.freedesktop.org/archives/xorg/2006-May/015136.html
  (* Security fix *)
patches/packages/x11-devel-6.8.2-i486-5.tgz:
  Patched and recompiled libXrender.
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Updated packages for Slackware 10.1:
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/x11-6.8.1-i486-5.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/x11-devel-6.8.1-i486-5.tgz

Updated packages for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/x11-6.8.2-i486-5.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/x11-devel-6.8.2-i486-5.tgz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/x11-6.9.0-i486-4.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/x11-devel-6.9.0-i486-4.tgz


MD5 signatures:
+-------------+

Slackware 10.1 packages:
0adae00722f78242961ebdd8e874a97e  x11-6.8.1-i486-5.tgz
7e1072009150f2d02bb958fdbf8920ed  x11-devel-6.8.1-i486-5.tgz

Slackware 10.2 packages:
95a228488f09978c4a3468fb027a49c8  x11-6.8.2-i486-5.tgz
86f2fe06649b2d120f8f0fb1ad76f341  x11-devel-6.8.2-i486-5.tgz

Slackware -current packages:
2aa5db26d003137c01d2688e644d0b9d  x11-6.9.0-i486-4.tgz
39b4feb60a97e79100962ebec50d9208  x11-devel-6.9.0-i486-4.tgz


Installation instructions:
+------------------------+

Upgrade the packages as root:
# upgradepkg x11-6.8.2-i486-5.tgz x11-devel-6.8.2-i486-5.tgz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)

iD8DBQFEWMvIakRjwEAQIjMRAjgWAKCIUqE8R9hUrNvvxCykVqF9FiTx7QCfSKO8
gwcRT2IwPdbHAxnS/o65kao=
=gg5L
-----END PGP SIGNATURE-----