From 859ebed168bf965efdcfd6d4256da2e24a4e9e04 Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Sun, 2 Aug 2020 20:47:14 +0200 Subject: Reference regression fix for CVE-2020-14344/libx11 --- data/CVE/list | 2 ++ 1 file changed, 2 insertions(+) diff --git a/data/CVE/list b/data/CVE/list index 73bf3c94a4..5e2572b5eb 100644 --- a/data/CVE/list +++ b/data/CVE/list @@ -4675,6 +4675,8 @@ CVE-2020-14344 [Heap corruption in the X input method client in libX11] NOTE: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/2fcfcc49f3b1be854bb9085993a01d17c62acf60 NOTE: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/1a566c9e00e5f35c1f9e7f3d741a02e5170852b2 NOTE: https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/1703b9f3435079d3c6021e1ee2ec34fd4978103d + NOTE: Original patchset introduces regression: https://bugs.debian.org/966691 + NOTE: Follow-up for regression: https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/116 CVE-2020-14343 [.load() and FullLoader still vulnerable to fairly trivial RCE] RESERVED - pyyaml (bug #966233) -- cgit v1.2.3