[SECURITY] [DSA 2213-1] x11-xserver-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2213-1 [email protected] http://www.debian.org/security/ Nico Golde April 8, 2011 http://www.debian.org/security/faq - -------------------------------------------------------------------------...

CVE-2011-0465

CVE-2011-0465 affects xrdb.c in xrdb before 1.0.9 used with X.Org X11R7.6 and earlier. The vulnerability allows remote attackers to execute arbitrary commands by injecting shell metacharacters into a hostname received via DHCP or XDMCP. Multiple advisories reference upgrading xrdb to 1.0.9 or app...

USN-1107-1: x11-xserver-utils vulnerability

Sebastian Krahmer discovered that the xrdb utility incorrectly filtered crafted hostnames. An attacker could use this flaw with a malicious DHCP server or with a remote xdmcp login and execute arbitrary code, resulting in root privilege escalation...

xrdb -- root hole via rogue hostname

Matthias Hopf reports: By crafting hostnames with shell escape characters, arbitrary commands can be executed in a root environment when a display manager reads in the resource database via xrdb. These specially crafted hostnames can occur in two environments: Systems are affected are: systems se...