CVE-2007-6429 Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used t...
HighCVSS 9.3
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used to calculate an amount of memory for allocation by the EVI extension, or (2) a request containing values related to pixmap size that are improperly used in management of shared memory by the MIT-SHM extension.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| x.org evi | All versions | No fix listed |
| x.org mit-shm | All versions | No fix listed |
| x.org xserver | <= 1.4 | No fix listed |
| debian/xorg-server(Debian:12) | < 2:1.4.1~git20080105-2 | 2:1.4.1~git20080105-2 |
| debian/xorg-server(Debian:13) | < 2:1.4.1~git20080105-2 | 2:1.4.1~git20080105-2 |
| debian/xorg-server(Debian:14) | < 2:1.4.1~git20080105-2 | 2:1.4.1~git20080105-2 |
References
- bugs.gentoo.org
- docs.info.apple.com
- SSRT080083 vendor-advisory
- 20080117 Multiple Vendor X Server EVI and MIT-SHM Extensions Integer Overflow Vulnerabilities third-party-advisory
- APPLE-SA-2008-03-18 vendor-advisory
- [xorg] 20080117 X.Org security advisory: multiple vulnerabilities in the X server mailing-list patch
- SUSE-SA:2008:003 vendor-advisory
- SUSE-SR:2008:003 vendor-advisory
- SUSE-SR:2008:008 vendor-advisory
- 28273 third-party-advisory
- 28532 third-party-advisory
- 28535 third-party-advisory
- 28536 third-party-advisory
- 28539 third-party-advisory
- 28540 third-party-advisory
- 28542 third-party-advisory
- 28543 third-party-advisory
- 28550 third-party-advisory
- 28584 third-party-advisory
- 28592 third-party-advisory
- 28616 third-party-advisory
- 28693 third-party-advisory
- 28718 third-party-advisory
- 28838 third-party-advisory
- 28843 third-party-advisory
- 28885 third-party-advisory
- 28941 third-party-advisory
- 29139 third-party-advisory
- 29420 third-party-advisory
- 29622 third-party-advisory
- 29707 third-party-advisory
- 30161 third-party-advisory
- 32545 third-party-advisory
- GLSA-200801-09 vendor-advisory
- GLSA-200804-05 vendor-advisory
- 1019232 vdb-entry
- 103200 patch vendor-advisory
- 200153 vendor-advisory
- support.avaya.com
- support.avaya.com
- DSA-1466 vendor-advisory
- GLSA-200805-07 vendor-advisory
- MDVSA-2008:021 vendor-advisory
- MDVSA-2008:022 vendor-advisory
- MDVSA-2008:023 vendor-advisory
- MDVSA-2008:025 vendor-advisory
- [4.1] 20080208 012: SECURITY FIX: February 8, 2008 vendor-advisory
- [4.2] 20080208 006: SECURITY FIX: February 8, 2008 vendor-advisory
- RHSA-2008:0029 vendor-advisory
- RHSA-2008:0030 vendor-advisory
- RHSA-2008:0031 vendor-advisory
- 20080130 rPSA-2008-0032-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs mailing-list
- 27336 patch vdb-entry
- 27350 vdb-entry
- 27353 vdb-entry
- ADV-2008-0179 vdb-entry
- ADV-2008-0184 vdb-entry
- ADV-2008-0497 vdb-entry
- ADV-2008-0703 vdb-entry
- ADV-2008-0924 vdb-entry
- ADV-2008-3000 vdb-entry
- www14.software.ibm.com
- xorg-evi-bo(39763) vdb-entry
- xorg-mitshm-overflow(39764) vdb-entry
- issues.rpath.com
- oval:org.mitre.oval:def:11045 signature vdb-entry
- USN-571-1 vendor-advisory
- FEDORA-2008-0760 vendor-advisory
- FEDORA-2008-0831 vendor-advisory
- Debian Security Tracker CVE-2007-6429 vendor-advisory