X Server multiple security vulnerabilities
Published:		13.06.2008
Source:		BUGTRAQ
SecurityVulns ID:		9079
Type:		local
Level:		7/10
Description:		Inteer overflows, memory corruptions, information leak in different extensions.

Affected:		XORG : X.Org 1.4
CVE:		CVE-2008-2362 (Multiple integer overflows in the Render extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via a (1) SProcRenderCreateLinearGradient, (2) SProcRenderCreateRadialGradient, or (3) SProcRenderCreateConicalGradient request with an invalid field specifying the number of bytes to swap in the request data, which triggers heap memory corruption.)
		CVE-2008-2361 (Integer overflow in the ProcRenderCreateCursor function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to cause a denial of service (daemon crash) via unspecified request fields that are used to calculate a glyph buffer size, which triggers a dereference of unmapped memory.)
		CVE-2008-2360 (Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that are used to calculate a heap buffer size, which triggers a heap-based buffer overflow.)
		CVE-2008-1379
		CVE-2008-1377

Original document		IDEFENSE, iDefense Security Advisory 06.11.08: Multiple Vendor X Server MIT-SHM Extension Information Disclosure Vulnerability (13.06.2008)
		IDEFENSE, iDefense Security Advisory 06.11.08: Multiple Vendor X Server Record and Security Extensions Multiple Memory Corruption Vulnerabilities (13.06.2008)
		IDEFENSE, iDefense Security Advisory 06.11.08: Multiple Vendor X Server Render Extension Gradient Creation Integer Overflow Vulnerability (13.06.2008)
		IDEFENSE, iDefense Security Advisory 06.11.08: Multiple Vendor X Server Render Extension ProcRenderCreateCursor() Integer Overflow Vulnerability (13.06.2008)
		IDEFENSE, iDefense Security Advisory 06.11.08: Multiple Vendor X Server Render Extension AllocateGlyph() Integer Overflow Vulnerability (13.06.2008)

Discuss:

Read or add your comments to this news (0 comments)