FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2011-4029

This CVE name corresponds to:

Entered	Topic
2011-10-18	Xorg server -- two vulnerabilities in X server lock handling code

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2011-4029 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2011-4029
Phase	Assigned(20111009)

Description

The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.

References

Source	Reference
MLIST	[xorg] 20111018 X.Org security advisory: xserver locking code issues
CONFIRM	http://cgit.freedesktop.org/xorg/xserver/commit/?id=b67581cf825940fdf52bf2e0af4330e695d724a4
REDHAT	RHSA-2012:0939
SECUNIA	46460
SECUNIA	49579