{"action":"created","issue":{"url":"https://api.github.com/repos/ArcticaProject/nx-libs/issues/29","labels_url":"https://api.github.com/repos/ArcticaProject/nx-libs/issues/29/labels{/name}","comments_url":"https://api.github.com/repos/ArcticaProject/nx-libs/issues/29/comments","events_url":"https://api.github.com/repos/ArcticaProject/nx-libs/issues/29/events","html_url":"https://github.com/ArcticaProject/nx-libs/issues/29","id":78875143,"number":29,"title":"CVE backports incomplete or wrong","user":{"login":"sunweaver","id":407231,"avatar_url":"https://avatars.githubusercontent.com/u/407231?v=3","gravatar_id":"","url":"https://api.github.com/users/sunweaver","html_url":"https://github.com/sunweaver","followers_url":"https://api.github.com/users/sunweaver/followers","following_url":"https://api.github.com/users/sunweaver/following{/other_user}","gists_url":"https://api.github.com/users/sunweaver/gists{/gist_id}","starred_url":"https://api.github.com/users/sunweaver/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sunweaver/subscriptions","organizations_url":"https://api.github.com/users/sunweaver/orgs","repos_url":"https://api.github.com/users/sunweaver/repos","events_url":"https://api.github.com/users/sunweaver/events{/privacy}","received_events_url":"https://api.github.com/users/sunweaver/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ArcticaProject/nx-libs/labels/security","name":"security","color":"eb6420"}],"state":"closed","locked":false,"assignee":{"login":"mikedep333","id":1698741,"avatar_url":"https://avatars.githubusercontent.com/u/1698741?v=3","gravatar_id":"","url":"https://api.github.com/users/mikedep333","html_url":"https://github.com/mikedep333","followers_url":"https://api.github.com/users/mikedep333/followers","following_url":"https://api.github.com/users/mikedep333/following{/other_user}","gists_url":"https://api.github.com/users/mikedep333/gists{/gist_id}","starred_url":"https://api.github.com/users/mikedep333/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikedep333/subscriptions","organizations_url":"https://api.github.com/users/mikedep333/orgs","repos_url":"https://api.github.com/users/mikedep333/repos","events_url":"https://api.github.com/users/mikedep333/events{/privacy}","received_events_url":"https://api.github.com/users/mikedep333/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/ArcticaProject/nx-libs/milestones/1","html_url":"https://github.com/ArcticaProject/nx-libs/milestones/3.6.0.x","labels_url":"https://api.github.com/repos/ArcticaProject/nx-libs/milestones/1/labels","id":1113295,"number":1,"title":"3.6.0.x","description":"Release goals for 3.6.0.x:\r\n\r\n* CVE security audit (complete)\r\n* remove unused code (+/- complete)\r\n* no bundled non-X11 libraries anymore (done)\r\n* no bundled Mesa library anymore (todo)\r\n* complete imake cleanup (work in progress)\r\n* replace as many liNX_X* libraries by X.org's libX* libraries (work in progress)\r\n* support for iOS (complete)\r\n","creator":{"login":"sunweaver","id":407231,"avatar_url":"https://avatars.githubusercontent.com/u/407231?v=3","gravatar_id":"","url":"https://api.github.com/users/sunweaver","html_url":"https://github.com/sunweaver","followers_url":"https://api.github.com/users/sunweaver/followers","following_url":"https://api.github.com/users/sunweaver/following{/other_user}","gists_url":"https://api.github.com/users/sunweaver/gists{/gist_id}","starred_url":"https://api.github.com/users/sunweaver/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sunweaver/subscriptions","organizations_url":"https://api.github.com/users/sunweaver/orgs","repos_url":"https://api.github.com/users/sunweaver/repos","events_url":"https://api.github.com/users/sunweaver/events{/privacy}","received_events_url":"https://api.github.com/users/sunweaver/received_events","type":"User","site_admin":false},"open_issues":11,"closed_issues":27,"state":"open","created_at":"2015-05-16T13:20:30Z","updated_at":"2015-06-02T19:55:28Z","due_on":"2015-10-14T22:00:00Z","closed_at":null},"comments":10,"created_at":"2015-05-21T07:42:36Z","updated_at":"2015-06-14T00:49:53Z","closed_at":"2015-05-31T15:16:09Z","body":"The below has been filed via X2Go BTS [1] by Ulrich Sibiller (@uli42)and should be fixed here (3.6.x branch) first before rebasing against 3.5.0.x.\r\n\r\n\"\"\"\r\nRecently a lot of CVE fixes have been added to nx-libs.\r\n\r\nE.g.\r\ndebian/patches/1027-render-check-request-size-before-reading-it-CVE.full.patch\r\nand\r\ndebian/patches/1028-render-unvalidated-lengths-in-Render-extn.-swap.full.patch\r\nadd missing checks to nx-X11/programs/Xserver/render/render.c.\r\n\r\nHowever, there's a file called\r\nnx-X11/programs/Xserver/hw/nxagent/NXrender.c which is derived from\r\nrender.c and in that file those checks are missing, too.\r\n\r\n(I suspect the original render/render.c is not used at all in favour\r\nof hw/nxagent/NXrender.c but I am not 100% sure here.)\r\n\r\nIf render.c is used a all (I am not sure) the patches should be\r\nextended to also fix NXrender.c.\r\nIf render.c is not used it should be removed and the patches should be\r\napplied to NXrender.c instead.\r\n\r\nThere might be more cases like this, I only picked this one as an example.\r\n\"\"\"\r\n\r\n[1] https://bugs.x2go.org/879"},"comment":{"url":"https://api.github.com/repos/ArcticaProject/nx-libs/issues/comments/111766094","html_url":"https://github.com/ArcticaProject/nx-libs/issues/29#issuecomment-111766094","issue_url":"https://api.github.com/repos/ArcticaProject/nx-libs/issues/29","id":111766094,"user":{"login":"mikedep333","id":1698741,"avatar_url":"https://avatars.githubusercontent.com/u/1698741?v=3","gravatar_id":"","url":"https://api.github.com/users/mikedep333","html_url":"https://github.com/mikedep333","followers_url":"https://api.github.com/users/mikedep333/followers","following_url":"https://api.github.com/users/mikedep333/following{/other_user}","gists_url":"https://api.github.com/users/mikedep333/gists{/gist_id}","starred_url":"https://api.github.com/users/mikedep333/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikedep333/subscriptions","organizations_url":"https://api.github.com/users/mikedep333/orgs","repos_url":"https://api.github.com/users/mikedep333/repos","events_url":"https://api.github.com/users/mikedep333/events{/privacy}","received_events_url":"https://api.github.com/users/mikedep333/received_events","type":"User","site_admin":false},"created_at":"2015-06-14T00:49:53Z","updated_at":"2015-06-14T00:49:53Z","body":"@uli42 No problem :)"}}