Security update for xorg-x11-server SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:3047-1 Final 1 1 2017-11-22T16:16:29Z current 2017-11-22T16:16:29Z 2017-11-22T16:16:29Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for xorg-x11-server This update for xorg-x11-server fixes several issues. These security issues were fixed: - CVE-2017-13721: Missing validation of shmseg resource id in Xext/XShm could lead to shared memory segments of other users beeing freed (bnc#1052984) - CVE-2017-13723: A local denial of service via unusual characters in XkbAtomText and XkbStringText was fixed (bnc#1051150) - CVE-2017-12184,CVE-2017-12185,CVE-2017-12186,CVE-2017-12187: Fixed unvalidated lengths in multiple extensions (bsc#1063034) - CVE-2017-12183: Fixed some unvalidated lengths in the XFIXES extension. (bsc#1063035) - CVE-2017-12180,CVE-2017-12181,CVE-2017-12182: Fixed various unvalidated lengths in the XFree86-VidMode/XFree86-DGA/XFree86-DRI extensions (bsc#1063037) - CVE-2017-12179: Fixed an integer overflow and unvalidated length in (S)ProcXIBarrierReleasePointer in Xi (bsc#1063038) - CVE-2017-12178: Fixed a wrong extra length check in ProcXIChangeHierarchy in Xi (bsc#1063039) - CVE-2017-12177: Fixed an unvalidated variable-length request in ProcDbeGetVisualInfo (bsc#1063040) - CVE-2017-12176: Fixed an unvalidated extra length in ProcEstablishConnection (bsc#1063041) These non-security issues were fixed: - Make colormap/gamma glue code work with the RandR extension disabled. This prevents it from crashing and showing wrong colors. (bsc#1061107) - Recognize ssh as a remote client to fix launching applications remotely when using DRI3. (bsc#1022727) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-DESKTOP-12-SP2-2017-1884,SUSE-SLE-DESKTOP-12-SP3-2017-1884,SUSE-SLE-RPI-12-SP2-2017-1884,SUSE-SLE-SDK-12-SP2-2017-1884,SUSE-SLE-SDK-12-SP3-2017-1884,SUSE-SLE-SERVER-12-SP2-2017-1884,SUSE-SLE-SERVER-12-SP3-2017-1884 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ Link for SUSE-SU-2017:3047-1 https://lists.suse.com/pipermail/sle-security-updates/2017-November/003402.html E-Mail link for SUSE-SU-2017:3047-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1022727 SUSE Bug 1022727 https://bugzilla.suse.com/1051150 SUSE Bug 1051150 https://bugzilla.suse.com/1052984 SUSE Bug 1052984 https://bugzilla.suse.com/1061107 SUSE Bug 1061107 https://bugzilla.suse.com/1063034 SUSE Bug 1063034 https://bugzilla.suse.com/1063035 SUSE Bug 1063035 https://bugzilla.suse.com/1063037 SUSE Bug 1063037 https://bugzilla.suse.com/1063038 SUSE Bug 1063038 https://bugzilla.suse.com/1063039 SUSE Bug 1063039 https://bugzilla.suse.com/1063040 SUSE Bug 1063040 https://bugzilla.suse.com/1063041 SUSE Bug 1063041 https://www.suse.com/security/cve/CVE-2017-12176/ SUSE CVE CVE-2017-12176 page https://www.suse.com/security/cve/CVE-2017-12177/ SUSE CVE CVE-2017-12177 page https://www.suse.com/security/cve/CVE-2017-12178/ SUSE CVE CVE-2017-12178 page https://www.suse.com/security/cve/CVE-2017-12179/ SUSE CVE CVE-2017-12179 page https://www.suse.com/security/cve/CVE-2017-12180/ SUSE CVE CVE-2017-12180 page https://www.suse.com/security/cve/CVE-2017-12181/ SUSE CVE CVE-2017-12181 page https://www.suse.com/security/cve/CVE-2017-12182/ SUSE CVE CVE-2017-12182 page https://www.suse.com/security/cve/CVE-2017-12183/ SUSE CVE CVE-2017-12183 page https://www.suse.com/security/cve/CVE-2017-12184/ SUSE CVE CVE-2017-12184 page https://www.suse.com/security/cve/CVE-2017-12185/ SUSE CVE CVE-2017-12185 page https://www.suse.com/security/cve/CVE-2017-12186/ SUSE CVE CVE-2017-12186 page https://www.suse.com/security/cve/CVE-2017-12187/ SUSE CVE CVE-2017-12187 page https://www.suse.com/security/cve/CVE-2017-13721/ SUSE CVE CVE-2017-13721 page https://www.suse.com/security/cve/CVE-2017-13723/ SUSE CVE CVE-2017-13723 page SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 xorg-x11-server-7.6_1.18.3-76.15.2 xorg-x11-server-extra-7.6_1.18.3-76.15.2 xorg-x11-server-sdk-7.6_1.18.3-76.15.2 xorg-x11-server-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Desktop 12 SP2 xorg-x11-server-extra-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Desktop 12 SP2 xorg-x11-server-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 xorg-x11-server-extra-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 xorg-x11-server-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Server 12 SP2 xorg-x11-server-extra-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Server 12 SP2 xorg-x11-server-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Server 12 SP3 xorg-x11-server-extra-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Server 12 SP3 xorg-x11-server-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 xorg-x11-server-extra-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 xorg-x11-server-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 xorg-x11-server-extra-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 xorg-x11-server-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 xorg-x11-server-extra-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 xorg-x11-server-sdk-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 xorg-x11-server-sdk-7.6_1.18.3-76.15.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12176 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12176.html CVE-2017-12176 https://bugzilla.suse.com/1063041 SUSE Bug 1063041 xorg-x11-server before 1.19.5 was vulnerable to integer overflow in ProcDbeGetVisualInfo function allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12177 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12177.html CVE-2017-12177 https://bugzilla.suse.com/1063040 SUSE Bug 1063040 xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12178 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12178.html CVE-2017-12178 https://bugzilla.suse.com/1063039 SUSE Bug 1063039 xorg-x11-server before 1.19.5 was vulnerable to integer overflow in (S)ProcXIBarrierReleasePointer functions allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12179 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12179.html CVE-2017-12179 https://bugzilla.suse.com/1063038 SUSE Bug 1063038 xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12180 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12180.html CVE-2017-12180 https://bugzilla.suse.com/1063037 SUSE Bug 1063037 xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12181 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12181.html CVE-2017-12181 https://bugzilla.suse.com/1063037 SUSE Bug 1063037 xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12182 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12182.html CVE-2017-12182 https://bugzilla.suse.com/1063037 SUSE Bug 1063037 xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12183 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12183.html CVE-2017-12183 https://bugzilla.suse.com/1063035 SUSE Bug 1063035 xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12184 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12184.html CVE-2017-12184 https://bugzilla.suse.com/1063034 SUSE Bug 1063034 xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12185 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12185.html CVE-2017-12185 https://bugzilla.suse.com/1063034 SUSE Bug 1063034 xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12186 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12186.html CVE-2017-12186 https://bugzilla.suse.com/1063034 SUSE Bug 1063034 xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code. CVE-2017-12187 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.6 AV:N/AC:H/Au:S/C:P/I:P/A:P 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-12187.html CVE-2017-12187 https://bugzilla.suse.com/1063034 SUSE Bug 1063034 In X.Org Server (aka xserver and xorg-server) before 1.19.4, an attacker authenticated to an X server with the X shared memory extension enabled can cause aborts of the X server or replace shared memory segments of other X clients in the same session. CVE-2017-13721 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 5.7 AV:L/AC:L/Au:S/C:P/I:P/A:C 1.9 AV:L/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-13721.html CVE-2017-13721 https://bugzilla.suse.com/1051150 SUSE Bug 1051150 https://bugzilla.suse.com/1052984 SUSE Bug 1052984 In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp. CVE-2017-13723 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Desktop 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:xorg-x11-server-extra-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP2:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 SUSE Linux Enterprise Software Development Kit 12 SP3:xorg-x11-server-sdk-7.6_1.18.3-76.15.2 moderate 4.4 AV:L/AC:M/Au:S/C:N/I:N/A:C 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20173047-1/ https://www.suse.com/security/cve/CVE-2017-13723.html CVE-2017-13723 https://bugzilla.suse.com/1051150 SUSE Bug 1051150 https://bugzilla.suse.com/1052984 SUSE Bug 1052984