From unknown Mon May 18 17:35:31 2026 X-Loop: owner@bugs.x2go.org Subject: Bug#879: [X2Go-Dev] Bug#879: CVE backports incomplete or wrong Reply-To: Mike Gabriel , 879@bugs.x2go.org Resent-From: Mike Gabriel Resent-To: x2go-dev@lists.x2go.org Resent-CC: X2Go Developers X-Loop: owner@bugs.x2go.org Resent-Date: Thu, 21 May 2015 08:20:02 +0000 Resent-Message-ID: Resent-Sender: owner@bugs.x2go.org X-X2Go-PR-Message: followup 879 X-X2Go-PR-Package: nx-libs X-X2Go-PR-Keywords: Received: via spool by 879-submit@bugs.x2go.org id=B879.143219636430206 (code B ref 879); Thu, 21 May 2015 08:20:02 +0000 Received: (at 879) by bugs.x2go.org; 21 May 2015 08:19:24 +0000 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on ymir.das-netzwerkteam.de X-Spam-Level: X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00,URIBL_BLOCKED autolearn=ham version=3.3.2 Received: from freya.das-netzwerkteam.de (freya.das-netzwerkteam.de [88.198.48.199]) by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id 1878C5DA84; Thu, 21 May 2015 10:19:21 +0200 (CEST) Received: from grimnir.das-netzwerkteam.de (grimnir.das-netzwerkteam.de [78.46.204.98]) by freya.das-netzwerkteam.de (Postfix) with ESMTPS id A4751FA6; Thu, 21 May 2015 10:19:21 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by grimnir.das-netzwerkteam.de (Postfix) with ESMTP id 6C1613BAE9; Thu, 21 May 2015 10:19:21 +0200 (CEST) X-Virus-Scanned: Debian amavisd-new at grimnir.das-netzwerkteam.de Received: from grimnir.das-netzwerkteam.de ([127.0.0.1]) by localhost (grimnir.das-netzwerkteam.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9eLjM-56Vdz6; Thu, 21 May 2015 10:19:21 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by grimnir.das-netzwerkteam.de (Postfix) with ESMTP id 297A33BAD9; Thu, 21 May 2015 10:19:21 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by grimnir.das-netzwerkteam.de (Postfix) with ESMTP id D7C103BAE9; Thu, 21 May 2015 10:19:20 +0200 (CEST) Received: from minobo.das-netzwerkteam.de (localhost [127.0.0.1]) by grimnir.das-netzwerkteam.de (Postfix) with ESMTP id B35043BAD9; Thu, 21 May 2015 10:19:18 +0200 (CEST) Received: by minobo.das-netzwerkteam.de (Postfix, from userid 1000) id 8E4E5BB1C3; Thu, 21 May 2015 10:02:10 +0200 (CEST) Date: Thu, 21 May 2015 10:02:10 +0200 From: Mike Gabriel To: Ulrich Sibiller , 879@bugs.x2go.org Cc: submit@bugs.x2go.org Message-ID: <20150521080207.GA23374@minobo.das-netzwerkteam.de> References: MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="liOOAslEiF7prFVr" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) --liOOAslEiF7prFVr Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Control: forwarded -1 https://github.com/ArcticaProject/nx-libs/issues/29 On Thu, May 21, 2015 at 08:43:37AM +0200, Ulrich Sibiller wrote: > Package: nx-libs >=20 > Recently a lot of CVE fixes have been added to nx-libs. >=20 > E.g. > debian/patches/1027-render-check-request-size-before-reading-it-CVE.full.= patch > and > debian/patches/1028-render-unvalidated-lengths-in-Render-extn.-swap.full.= patch > add missing checks to nx-X11/programs/Xserver/render/render.c. >=20 > However, there's a file called > nx-X11/programs/Xserver/hw/nxagent/NXrender.c which is derived from > render.c and in that file those checks are missing, too. >=20 > (I suspect the original render/render.c is not used at all in favour > of hw/nxagent/NXrender.c but I am not 100% sure here.) >=20 > If render.c is used a all (I am not sure) the patches should be > extended to also fix NXrender.c. > If render.c is not used it should be removed and the patches should be > applied to NXrender.c instead. >=20 > There might be more cases like this, I only picked this one as an example. Forwarded to nx-libs bug tracker [1] for nx-libs 3.6.x on Github. @Mike#2: I assigned you to this task on Github. If you are not available for this, please assign me again. What Ulrich and I realized (in private comm) lately is that there are some = files in hw/nxagent/ that are actually Xlib (extension) copies-of-code. Thus, we need to double-maintain those code sections (I know, it is a mess = and needs to be cleared up finally). o step A: build against libX* from X.Org o step B: be aware for code passages being libX* code, but copied to hw/nxagent/ and maintain those passages in hw/nxagent/ for now Greets, Mike [1] https://github.com/ArcticaProject/nx-libs/issues/29 --=20 DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de --liOOAslEiF7prFVr Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJVXZD/AAoJEJr0azAldxsxrA4QALfh5jJ1ELEne8OL7mk+abWU +2B9u+A5c1jvGnSdKX3LtJHokKOqK9jnCuZjMsVacow/XXT4OQxMOEhjExGbfcyz r/QFBi7o55GWu3R4wzifGYdkZhDVquoXfWHib3qVrryLuxXcxlFEoeGyGk7B7dqF wxh0pGyE5vo7eBBYAadDjWD+7WRM387Eigsi2gwB6WgVtCX2w276RKDY0GIdE5g/ h0LbLXqs1rEexhvFkpy++gIrTsEXrKmtGixb99g3XnHmnD+tVVKT528c/bC3qsOs FmxEU2mC9h9hE8P73yhP2RPzdVVsNY4itZIjMFsl6K0ba6vKvyuRfDqiIhdgyxG5 DrUVIcjKOPPMHNhYPzSDSQB9ByqKxJtmU90HqoR77SMy/YuwydUxXszOPz7drgLI fbr9/cf3WLpB7h2nwaQX+bzoUEnvWgyG26GnoG4Be9uHgC/i8TFPyf1ZvDJk+GdZ s9LOrVHSmeSv1SmqyFxJ2F+BOYfjoEbnkO6eMPD+dsHNnV7LR7UquBr9ySoKm+Rh PU0TkAPaFHYmbLRMRHGEfSSuo5b7Ke5DNUyhiZAN+bIXKxT4Jkm0EAGi2oi8DPUo MHUd7qcepMCS2tX1goagiVz0+23suKhzcQW0p0VHdxbZsEksdLEO18VeaQrz8xFl bGH83Q22VEM2RKq64mfK =bVIM -----END PGP SIGNATURE----- --liOOAslEiF7prFVr--