From: "Andrew van der Stock" <ajv@greebo.net>
To: <lwn@lwn.net>
Subject: Xfree86 Security Fixes
Date: Tue, 20 Mar 2001 10:59:45 +1100

Hi Liz,

just a quick note to follow up your article on XFree86's security issues
from last October:
http://lwn.net/2000/1026/security.php3

I'd advise all your readers to move to Xfree86 4.0.3 as it is the fastest,
most stable, and definitely most secure version of XFree86.

Chris Evans had pointed out the following issues:

- X server DoS in XCSECURITY authentication code
	Fixed in 4.0.1
- libICE DoS
	Fixed in 4.0.1
- CPU DoS in XOpenDisplay
	Fixed in 4.0.2
- (I think) A malloc() error in XOpenDisplay
	Fixed in 4.0.2
- A nasty stack corruption bug in the event handling
	[Not enough information to fix this one]

In addition, the following security fixes are in 4.0.3:

1217. [SECURITY] Fix temp files vulnerabilites in xman on systems with
      mkstemp(). (Matthieu Herrb).
1216. [SECURITY] Fix temp vulnerabilities in Xaw/MultiSrc.c using the
technique
      in patch #4279 (Branden Robinson). Fix temp file vulnerability in
      gccmakedep based on report from Alan Cox. Fix temp file vulnerability
      in Imake.rules, InstallManPageAliases (Matthieu Herrb).

I'd just like to point out the great work done by Branden Robinson, Matthieu
Herrb, and David Dawes in getting these fixes done.

Moral to story: unless you have a card that is not supported by 4.0.3, it's
time to ditch 3.3.x. If you have a card that is not supported by 4.0.x,
please help us bring it forward.

Andrew van der Stock
ajv@greebo.net