From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
To: buildroot@busybox.net
Subject: [Buildroot] [PATCH 1/1] package/x11r7/xserver_xorg-server: add security fix for CVE-2020-14347
Date: Tue, 11 Aug 2020 23:49:06 +0200 [thread overview]
Message-ID: <20200811234906.051e8caa@windsurf.home> (raw)
In-Reply-To: <20200810064109.447089-1-bernd.kuhls@t-online.de>
On Mon, 10 Aug 2020 08:41:09 +0200
Bernd Kuhls <bernd.kuhls@t-online.de> wrote:
> Release notes:
> https://lists.x.org/archives/xorg-announce/2020-July/003051.html
>
> Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
> ---
> .../1.20.8/0007-fix-for-ZDI-11426.patch | 36 +++++++++++++++++++
> 1 file changed, 36 insertions(+)
> create mode 100644 package/x11r7/xserver_xorg-server/1.20.8/0007-fix-for-ZDI-11426.patch
You had forgotten to set XSERVER_XORG_SERVER_IGNORE_CVES to ignore
CVE-2020-14347 now that it is fixed by your patch. I have done so when
the selected X.org version is 1.20.
This raises a question: what about the older X.org server releases?
According to the NIST CVE entry, all versions prior to 1.20.9 are
affected, so should the patch be backported to the other X.org server
versions we support ?
Best regards,
Thomas
--
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
next prev parent reply other threads:[~2020-08-11 21:49 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-10 6:41 [Buildroot] [PATCH 1/1] package/x11r7/xserver_xorg-server: add security fix for CVE-2020-14347 Bernd Kuhls
2020-08-11 21:49 ` Thomas Petazzoni [this message]
2020-08-28 17:03 ` Bernd Kuhls
2020-08-28 18:48 ` Peter Korsgaard
2020-08-29 11:36 ` Bernd Kuhls
2020-08-28 15:54 ` Peter Korsgaard
[not found] ` <fbd81a16-35f0-5e1a-73fb-1b9c703a9408@t-online.de>
2020-08-28 18:56 ` [Buildroot] [PATCH 1/1] package/x11r7/xserver_xorg-server: add security fix Thomas Petazzoni
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200811234906.051e8caa@windsurf.home \
--to=thomas.petazzoni@bootlin.com \
--cc=buildroot@busybox.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.