Another X.Org Security Advisory Disclosed Today

[phoronix]

Phoronix: Another X.Org Security Advisory Disclosed Today

Security researcher Ilja van Sprundel previously characterized the X.Org security scene as being a disaster. This researcher at IOActive has previously reported a large number of X.Org security issues and today is yet another advisory thanks to Ilja...

http://www.phoronix.com/scan.php?page=news_item&px=BDF-File-Parsing-libXfont

[Azrael5]

X.org is useless complex old platform which penalizes Linux systems, it has to be abandoned replaced by wayland.

[uid313]

It is absurd that X.Org Server still runs as root.

Hope to see more old cruft gets burned by fire in the next X.Org release.

[Ericg]

It is absurd that X.Org Server still runs as root.

Hope to see more old cruft gets burned by fire in the next X.Org release.

Runs as user if using logind (at least on Fedora, idk if those patches got propagated out to other distros) and the open source drivers. If you don't use a login manager you can run xorg as user without logind if your user is in the input group and you start xorg via "startx"

[Azrael5]

[gens]

It is absurd that X.Org Server still runs as root.

Hope to see more old cruft gets burned by fire in the next X.Org release.

X does not have to run as root ever since DRM got into the kernel

@ Azrael5; not yet, on desktop that is

[dungeon]

Good catch Ilja

I nearly forget this is about security fix while reading comments

[JS987]

X.org is useless complex old platform which penalizes Linux systems, it has to be abandoned replaced by wayland.

All software written in C including Wayland can have security bugs like buffer overflows.

[zeehio]

All software written in C including Wayland can have security bugs like buffer overflows.

But only old software can have old bugs.

And it is usually easier to audit and review fresh code than old code.

[uid313]

All software written in C including Wayland can have security bugs like buffer overflows.

Maybe they should rewrite Wayland in Rust then...