Control: tags -1 + patch Hi
On Thu, Nov 26, 2020 at 05:59:50AM +0100, Salvatore Bonaccorso wrote: > Source: x11vnc > Version: 0.9.13-6 > Severity: grave > Tags: security upstream fixed-upstream > Justification: user security hole > X-Debbugs-Cc: car...@debian.org, Debian Security Team > <t...@security.debian.org> > Control: found -1 0.9.16-4 > > Hi, > > The following vulnerability was published for x11vnc. > > CVE-2020-29074[0]: > | scan.c in x11vnc 0.9.16 uses IPC_CREAT|0777 in shmget calls, which > | allows access by actors other than the current user. > > > If you fix the vulnerability please also make sure to include the > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > For further information see: > > [0] https://security-tracker.debian.org/tracker/CVE-2020-29074 > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29074 > [1] > https://github.com/LibVNC/x11vnc/commit/69eeb9f7baa14ca03b16c9de821f9876def7a36a > > Given the relative minor change I have already picked up the commit > for a buster-security update as well. For unstable I openend https://salsa.debian.org/debian-remote-team/x11vnc/-/merge_requests/2 Regards, Salvatore
From: =?UTF-8?q?Gu=C3=A9nal=20DAVALAN?= <guenal.dava...@uca.fr> Date: Wed, 18 Nov 2020 08:40:45 +0100 Subject: scan: limit access to shared memory segments to current user Origin: https://github.com/LibVNC/x11vnc/commit/69eeb9f7baa14ca03b16c9de821f9876def7a36a Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2020-29074 Bug-Debian: https://bugs.debian.org/975875 --- src/scan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/scan.c b/src/scan.c index 43e00d20aaae..12994d521f22 100644 --- a/src/scan.c +++ b/src/scan.c @@ -320,7 +320,7 @@ static int shm_create(XShmSegmentInfo *shm, XImage **ximg_ptr, int w, int h, #if HAVE_XSHM shm->shmid = shmget(IPC_PRIVATE, - xim->bytes_per_line * xim->height, IPC_CREAT | 0777); + xim->bytes_per_line * xim->height, IPC_CREAT | 0600); if (shm->shmid == -1) { rfbErr("shmget(%s) failed.\n", name); -- 2.20.1
