Repository navigation
fix(cve): CVE-2026-94284 - ximcp: bound XIM_REGISTER_TRIGGERKEYS keylist lengths to the packet - #12
Merged
Merged
Conversation
…ist lengths to the packet CVE: CVE-2026-94284 (unknown) - X.Org libX11 的 ximcp 模块存在越界读取漏洞：_XimRegisterTriggerKeysCallback() 从传输层收到完整数据包长度，但未将其传给 _XimRegisterTriggerkey()，后者直接信任报文中的 on-keys 与 off-keys 长度字段用于 Xmalloc 与 memcpy 操作。攻击者可构造外层帧合法但内层长度字段超大的恶意 XIM_REGISTER_TRIGGERKEYS 消息，导致越界读取并使客户端崩溃。 Upstream: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/924fc91f08ece9cddc93609b4dc945a9cc90ea12 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
Contributor
Author
|
/hold |
Contributor
Author
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
TAG Bot TAG: 2%1.8.12-1deepin2 |
…ths to the received packet CVE: CVE-2026-94283 (unknown) - _XimGetAttributeID() trusted the wire-embedded nBytesIMATTR/nBytesICATTR values and per-attribute lengths from a malicious or malformed XIM_OPEN_REPLY without comparing them to the actual number of bytes returned by _XimRead(), allowing potential out-of-bounds reads (and possible client crashes) while parsing IM/IC attribute lists. Upstream: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/f263bbca24d04c766775e7af2e203ca41b4ece2e Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
…ds to remaining input length CVE: CVE-2026-94285 (unknown) - X.Org libX11 的 lcGenConv 模块存在越界读取漏洞：byteM_parse_codeset() 遍历候选字节型字符集时会按 codeset->length 解引用输入缓冲区，但未接收剩余输入长度参数，也未在读取前检查可用字节数。当输入末尾的字节是多字节字符集（如 GBK、Big5）的合法首字节时，函数在匹配第二字节范围时会读取超出调用方缓冲区一个字节的数据。修复方案为将剩余字节数传入 byteM_parse_codeset()，并跳过长度超出可用输入的候选字符集。 Upstream: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/797eaf0bd69524144e0df7af516b680f4b7694e9 Co-authored-by: hudeng <hudeng@deepin.org> Generated-By: deepseek-v4-flash
Contributor
|
/integrate |
This was referenced Oct 29, 2026
|
AutoIntegrationPr Bot |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE: CVE-2026-94284 (unknown) - X.Org libX11 的 ximcp 模块存在越界读取漏洞：_XimRegisterTriggerKeysCallback() 从传输层收到完整数据包长度，但未将其传给 _XimRegisterTriggerkey()，后者直接信任报文中的 on-keys 与 off-keys 长度字段用于 Xmalloc 与 memcpy 操作。攻击者可构造外层帧合法但内层长度字段超大的恶意 XIM_REGISTER_TRIGGERKEYS 消息，导致越界读取并使客户端崩溃。
Upstream: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/924fc91f08ece9cddc93609b4dc945a9cc90ea12
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-94283 (unknown) - _XimGetAttributeID() trusted the wire-embedded nBytesIMATTR/nBytesICATTR values and per-attribute lengths from a malicious or malformed XIM_OPEN_REPLY without comparing them to the actual number of bytes returned by _XimRead(), allowing potential out-of-bounds reads (and possible client crashes) while parsing IM/IC attribute lists.
Upstream: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/f263bbca24d04c766775e7af2e203ca41b4ece2e
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash
CVE: CVE-2026-94285 (unknown) - X.Org libX11 的 lcGenConv 模块存在越界读取漏洞：byteM_parse_codeset() 遍历候选字节型字符集时会按 codeset->length 解引用输入缓冲区，但未接收剩余输入长度参数，也未在读取前检查可用字节数。当输入末尾的字节是多字节字符集（如 GBK、Big5）的合法首字节时，函数在匹配第二字节范围时会读取超出调用方缓冲区一个字节的数据。修复方案为将剩余字节数传入 byteM_parse_codeset()，并跳过长度超出可用输入的候选字符集。
Upstream: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/797eaf0bd69524144e0df7af516b680f4b7694e9
Co-authored-by: hudeng hudeng@deepin.org
Generated-By: deepseek-v4-flash