-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  xorg-server (SSA:2023-088-02)

New xorg-server packages are available for Slackware 15.0 and -current to
fix a security issue.


Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/xorg-server-1.20.14-i586-8_slack15.0.txz:  Rebuilt.
  [PATCH] composite: Fix use-after-free of the COW.
  Fix use-after-free that can lead to local privileges elevation on systems
  where the X server is running privileged and remote code execution for ssh
  X forwarding sessions.
  For more information, see:
    https://lists.x.org/archives/xorg-announce/2023-March/003374.html
    https://www.cve.org/CVERecord?id=CVE-2023-1393
  (* Security fix *)
patches/packages/xorg-server-xephyr-1.20.14-i586-8_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xnest-1.20.14-i586-8_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xvfb-1.20.14-i586-8_slack15.0.txz:  Rebuilt.
patches/packages/xorg-server-xwayland-21.1.4-i586-7_slack15.0.txz:  Rebuilt.
  [PATCH] composite: Fix use-after-free of the COW.
  Fix use-after-free that can lead to local privileges elevation on systems
  where the X server is running privileged and remote code execution for ssh
  X forwarding sessions.
  For more information, see:
    https://lists.x.org/archives/xorg-announce/2023-March/003374.html
    https://www.cve.org/CVERecord?id=CVE-2023-1393
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated packages for Slackware 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-1.20.14-i586-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xephyr-1.20.14-i586-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xnest-1.20.14-i586-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xvfb-1.20.14-i586-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware-15.0/patches/packages/xorg-server-xwayland-21.1.4-i586-7_slack15.0.txz

Updated packages for Slackware x86_64 15.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-1.20.14-x86_64-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xephyr-1.20.14-x86_64-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xnest-1.20.14-x86_64-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xvfb-1.20.14-x86_64-8_slack15.0.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-15.0/patches/packages/xorg-server-xwayland-21.1.4-x86_64-7_slack15.0.txz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-21.1.8-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xephyr-21.1.8-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xnest-21.1.8-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xvfb-21.1.8-i586-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/x/xorg-server-xwayland-23.1.1-i586-1.txz

Updated packages for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-21.1.8-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xephyr-21.1.8-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xnest-21.1.8-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xvfb-21.1.8-x86_64-1.txz
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/x/xorg-server-xwayland-23.1.1-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 15.0 packages:
6d6a0629c73c3562c6eddfded160d8b5  xorg-server-1.20.14-i586-8_slack15.0.txz
3318631ca262facba1c44661f2c52e50  xorg-server-xephyr-1.20.14-i586-8_slack15.0.txz
b0cd131a9616ca533dc0e0f7116f6040  xorg-server-xnest-1.20.14-i586-8_slack15.0.txz
9d88240e55079c1e775aeaf33d5b58b6  xorg-server-xvfb-1.20.14-i586-8_slack15.0.txz
c21182933e39e2529ff0c724259b6cf2  xorg-server-xwayland-21.1.4-i586-7_slack15.0.txz

Slackware x86_64 15.0 packages:
c87c5923b4f58c0f4a70f05fb7e1ef46  xorg-server-1.20.14-x86_64-8_slack15.0.txz
3f8be8a91d878cac51bea5607704f159  xorg-server-xephyr-1.20.14-x86_64-8_slack15.0.txz
19c0f2f489ce625782410ef122e47ad2  xorg-server-xnest-1.20.14-x86_64-8_slack15.0.txz
ae86d6c2ecbad37e552206d0ba89abc5  xorg-server-xvfb-1.20.14-x86_64-8_slack15.0.txz
2624310c22eced24c8528221f8748279  xorg-server-xwayland-21.1.4-x86_64-7_slack15.0.txz

Slackware -current packages:
09835a9ed69b0a6c3e652a3dd258133b  x/xorg-server-21.1.8-i586-1.txz
bf4d090c96f78ff7722f363efd33cd03  x/xorg-server-xephyr-21.1.8-i586-1.txz
935ecf67a638a2db75623e965e23766e  x/xorg-server-xnest-21.1.8-i586-1.txz
8371b8e10d60d7009d205d049df007c7  x/xorg-server-xvfb-21.1.8-i586-1.txz
71c580fc4e1cf5d364c3071ab421bd79  x/xorg-server-xwayland-23.1.1-i586-1.txz

Slackware x86_64 -current packages:
780cca076058e19c632da1cd57d1568d  x/xorg-server-21.1.8-x86_64-1.txz
2c4d467c2deb0f77fedac8fa99d31b61  x/xorg-server-xephyr-21.1.8-x86_64-1.txz
00256961e9af4895fc08e0251038118a  x/xorg-server-xnest-21.1.8-x86_64-1.txz
9375d57d667c627e6757e65a96685aff  x/xorg-server-xvfb-21.1.8-x86_64-1.txz
5cfd4343450dc2c76fb39e7c54fcedd0  x/xorg-server-xwayland-23.1.1-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the packages as root:
# upgradepkg xorg-server-*.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAmQkpqYACgkQakRjwEAQIjM63ACeI5l1bYJVakqe6hkqaQTYTQ7K
bc8AoJI/0if5FNrpRZQWPlW9hH6enHSI
=InCh
-----END PGP SIGNATURE-----