Control: severity -1 grave Hi,
On Tue, May 18, 2021 at 09:13:18PM +0200, Salvatore Bonaccorso wrote: > Source: libx11 > Version: 2:1.7.0-2 > Severity: important > Tags: security upstream > X-Debbugs-Cc: car...@debian.org, Debian Security Team > <t...@security.debian.org> > > Hi, > > The following vulnerability was published for libx11. > > CVE-2021-31535[0]: > | Missing request length checks > > If you fix the vulnerability please also make sure to include the > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > For further information see: > > [0] https://security-tracker.debian.org/tracker/CVE-2021-31535 > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31535 > [1] https://www.openwall.com/lists/oss-security/2021/05/18/2 > [2] > https://gitlab.freedesktop.org/xorg/lib/libx11/-/commit/8d2e02ae650f00c4a53deb625211a0527126c605 > [3] https://bugzilla.suse.com/show_bug.cgi?id=1182506 Raising the severity to RC, even if for bullseye/unstable the xterm case is mitigated due we have a version with patch #367 applied. Regards, Salvatore