Debian Security Advisory
DSA-4920-1 libx11 -- security update
- Date Reported:
- 24 May 2021
- Affected Packages:
- Security database references:
- In the Debian bugtracking system: Bug 988737.
In Mitre's CVE dictionary: CVE-2021-31535.
- More information:
Roman Fiedler reported that missing length validation in various functions provided by libx11, the X11 client-side library, allow to inject X11 protocol commands on X clients, leading to authentication bypass, denial of service or potentially the execution of arbitrary code.
For the stable distribution (buster), this problem has been fixed in version 2:1.6.7-1+deb10u2.
We recommend that you upgrade your libx11 packages.
For the detailed security status of libx11 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libx11