CVE-2007-2437 The X render (Xrender) extension in X.org X Window System 7.0, 7.1, and 7.2, with Xserver 1.3.0 and earlier, allows remote authenticated users to cause a denial of service (daemon crash) via crafted v...
MediumCVSS 5.5
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The X render (Xrender) extension in X.org X Window System 7.0, 7.1, and 7.2, with Xserver 1.3.0 and earlier, allows remote authenticated users to cause a denial of service (daemon crash) via crafted values to the (1) XRenderCompositeTrapezoids and (2) XRenderAddTraps functions, which trigger a divide-by-zero error.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| x.org x window system | = 7.0 | No fix listed |
| x.org x window system | = 7.1 | No fix listed |
| x.org x window system | = 7.2 | No fix listed |
| x.org xserver | <= 1.3.0 | No fix listed |
| debian/xorg-server(Debian:12) | < 2:1.3.0.0.dfsg-4 | 2:1.3.0.0.dfsg-4 |
| debian/xorg-server(Debian:13) | < 2:1.3.0.0.dfsg-4 | 2:1.3.0.0.dfsg-4 |
| debian/xorg-server(Debian:14) | < 2:1.3.0.0.dfsg-4 | 2:1.3.0.0.dfsg-4 |
References
- Debian Security Tracker CVE-2007-2437 vendor-advisory
- bugs.debian.org issue-tracking
- 34905 vdb-entry
- 25121 third-party-advisory
- 102901 vendor-advisory
- 200067 vendor-advisory
- www.rapid7.com patch
- 23741 vdb-entry
- 1017984 patch vdb-entry
- ADV-2007-1601 vdb-entry
- ADV-2007-1658 vdb-entry
- xorg-xrender-dos(33976) vdb-entry