From 1b88e51befd82710928edffe916823ccb80e1457 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Mon, 1 Mar 2021 16:29:20 +0100 Subject: [PATCH 1/2] Indent a spec file --- x11vnc.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/x11vnc.spec b/x11vnc.spec index 0fb86c7..f0d2c79 100644 --- a/x11vnc.spec +++ b/x11vnc.spec @@ -57,7 +57,6 @@ Patch2: x11vnc-0.9.16-Fix-build-with-fno-common.patch # Fix a NULL pointer dereference in a cursor handler, upstream bug #123, in # upstream after 0.9.16 Patch3: x11vnc-0.9.16-src-cursor-fix-xfc-NULL-pointer-dereference.patch -BuildRequires: make BuildRequires: autoconf BuildRequires: automake # for autogen.sh script @@ -71,6 +70,7 @@ BuildRequires: libXfixes-devel BuildRequires: libXinerama-devel BuildRequires: libXrandr-devel BuildRequires: libXtst-devel +BuildRequires: make BuildRequires: openssl-devel BuildRequires: pkgconf-pkg-config BuildRequires: pkgconfig(avahi-client) >= 0.6.4 From 8bdefe9d89f2a69c4a26472454e97e8e5b523159 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= Date: Mon, 1 Mar 2021 17:44:54 +0100 Subject: [PATCH 2/2] Fix CVE-2020-29074 (insecure permissions on a shared memory) --- ...s-to-shared-memory-segments-to-curre.patch | 29 +++++++++++++++++++ x11vnc.spec | 9 +++++- 2 files changed, 37 insertions(+), 1 deletion(-) create mode 100644 x11vnc-0.9.16-scan-limit-access-to-shared-memory-segments-to-curre.patch diff --git a/x11vnc-0.9.16-scan-limit-access-to-shared-memory-segments-to-curre.patch b/x11vnc-0.9.16-scan-limit-access-to-shared-memory-segments-to-curre.patch new file mode 100644 index 0000000..5c2f8b1 --- /dev/null +++ b/x11vnc-0.9.16-scan-limit-access-to-shared-memory-segments-to-curre.patch @@ -0,0 +1,29 @@ +From 69eeb9f7baa14ca03b16c9de821f9876def7a36a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Gu=C3=A9nal=20DAVALAN?= +Date: Wed, 18 Nov 2020 08:40:45 +0100 +Subject: [PATCH] scan: limit access to shared memory segments to current user +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Petr Písař +--- + src/scan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/scan.c b/src/scan.c +index 43e00d2..12994d5 100644 +--- a/src/scan.c ++++ b/src/scan.c +@@ -320,7 +320,7 @@ static int shm_create(XShmSegmentInfo *shm, XImage **ximg_ptr, int w, int h, + + #if HAVE_XSHM + shm->shmid = shmget(IPC_PRIVATE, +- xim->bytes_per_line * xim->height, IPC_CREAT | 0777); ++ xim->bytes_per_line * xim->height, IPC_CREAT | 0600); + + if (shm->shmid == -1) { + rfbErr("shmget(%s) failed.\n", name); +-- +2.26.2 + diff --git a/x11vnc.spec b/x11vnc.spec index f0d2c79..beeaeb1 100644 --- a/x11vnc.spec +++ b/x11vnc.spec @@ -1,6 +1,6 @@ Name: x11vnc Version: 0.9.16 -Release: 4%{?dist} +Release: 5%{?dist} Summary: VNC server for the current X11 session Summary(ru): VNC-сервер для текущей сессии X11 # COPYING: GPLv2 text @@ -57,6 +57,9 @@ Patch2: x11vnc-0.9.16-Fix-build-with-fno-common.patch # Fix a NULL pointer dereference in a cursor handler, upstream bug #123, in # upstream after 0.9.16 Patch3: x11vnc-0.9.16-src-cursor-fix-xfc-NULL-pointer-dereference.patch +# Fix CVE-2020-29074 (insecure permissions on a shared memory), bug #1933603, +# in upstream after 0.9.16 +Patch4: x11vnc-0.9.16-scan-limit-access-to-shared-memory-segments-to-curre.patch BuildRequires: autoconf BuildRequires: automake # for autogen.sh script @@ -114,6 +117,7 @@ a versatile and productive while still easy to use program. %patch1 -p1 %patch2 -p1 %patch3 -p1 +%patch4 -p1 %build autoreconf -fi @@ -154,6 +158,9 @@ desktop-file-validate %{buildroot}/%{_datadir}/applications/x11vnc.desktop %{_mandir}/man1/x11vnc.1* %changelog +* Mon Mar 01 2021 Petr Pisar - 0.9.16-5 +- Fix CVE-2020-29074 (insecure permissions on a shared memory) (bug #1933603) + * Wed Jul 29 2020 Fedora Release Engineering - 0.9.16-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild