Subject: Bug#4332: Vulnerability in the Xt library (fwd)

From: Owen Dunn <[email-masked]>
Date: Tue, 3 Sep 1996 23:19:09 +0100

On Thu, 29 Aug 1996, Marek Michalkiewicz wrote:

> Package: xlib
> Version: 3.1.2-7
> 
> It seems there is a buffer overrun in libXt, which may be a security
> hole (some programs using libXt, such as xterm, are setuid root).
> I haven't tried to exploit it, but xterm -fg very_long_string
> segfaults, so it might be exploitable (stack overwrite).  See the
> attached message (which appeared on the bugtraq list) for a patch.

I'm currently trying to clear some of Steve Early's backlog of X
package bugs; this'll be among them (though it may be a while longer
before the packages get converted to the new source format.)

(S)

---

From: Marek Michalkiewicz <[email-masked]>
Date: Thu, 5 Sep 1996 15:01:08 +0200 (MET DST)

> before the packages get converted to the new source format.)

Thanks.  One suggestion: this particular bug is a quite serious
one (uid 0 exploit for FreeBSD has been posted to bugtraq; it
probably wouldn't be too hard for someone to adapt it for Linux).
So I think the fix should go in the "stable" tree as well, before
converting to the new format...

Marek