Alan Coopersmith 6692670fde dri2: integer overflow in ProcDRI2GetBuffers() [CVE-2014-8094] ...

ProcDRI2GetBuffers() tries to validate a length field (count).
There is an integer overflow in the validation. This can cause
out of bound reads and memory corruption later on.

Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
Signed-off-by: Alan Coopersmith <alan.coopersmith@oracle.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Reviewed-by: Julien Cristau <jcristau@debian.org>

2014-12-08 18:09:47 -08:00

..

dmx

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

kdrive

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

vfb

vfb: Don't reimplement micmap so much

2014-10-08 10:10:39 +02:00

xfree86

dri2: integer overflow in ProcDRI2GetBuffers() [CVE-2014-8094]

2014-12-08 18:09:47 -08:00

xnest

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

xquartz

Drop trailing whitespaces

2014-11-12 10:25:00 +10:00

xwayland

xwayland: declare fatal log handler as noreturn

2014-11-12 10:25:00 +10:00

xwin

Merge remote-tracking branch 'jturney/master'

2014-12-08 18:04:08 -08:00

Makefile.am

Xwayland DDX

2014-04-03 15:19:22 -07:00