Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
centosCentOS ProjectCESA-2007:0125
HistoryApr 03, 2007 - 10:05 p.m.

XFree86 security update

2007-04-0322:05:23
CentOS Project
lists.centos.org
52

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.05 Low

EPSS

Percentile

92.8%

JSON

CentOS Errata and Security Advisory CESA-2007:0125

XFree86 is an implementation of the X Window System, which provides the
core functionality for the Linux graphical desktop.

iDefense reported an integer overflow flaw in the XFree86 XC-MISC
extension. A malicious authorized client could exploit this issue to cause
a denial of service (crash) or potentially execute arbitrary code with root
privileges on the XFree86 server. (CVE-2007-1003)

iDefense reported two integer overflows in the way X.org handled various
font files. A malicious local user could exploit these issues to
potentially execute arbitrary code with the privileges of the X.org server.
(CVE-2007-1351, CVE-2007-1352)

An integer overflow flaw was found in the XFree86 XGetPixel() function.
Improper use of this function could cause an application calling it to
function improperly, possibly leading to a crash or arbitrary code
execution. (CVE-2007-1667)

Users of XFree86 should upgrade to these updated packages, which contain a
backported patch and is not vulnerable to this issue.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2007-April/075802.html
https://lists.centos.org/pipermail/centos-announce/2007-April/075803.html
https://lists.centos.org/pipermail/centos-announce/2007-April/075805.html
https://lists.centos.org/pipermail/centos-announce/2007-April/075814.html

Affected packages:
XFree86
XFree86-100dpi-fonts
XFree86-75dpi-fonts
XFree86-ISO8859-14-100dpi-fonts
XFree86-ISO8859-14-75dpi-fonts
XFree86-ISO8859-15-100dpi-fonts
XFree86-ISO8859-15-75dpi-fonts
XFree86-ISO8859-2-100dpi-fonts
XFree86-ISO8859-2-75dpi-fonts
XFree86-ISO8859-9-100dpi-fonts
XFree86-ISO8859-9-75dpi-fonts
XFree86-Mesa-libGL
XFree86-Mesa-libGLU
XFree86-Xnest
XFree86-Xvfb
XFree86-base-fonts
XFree86-cyrillic-fonts
XFree86-devel
XFree86-doc
XFree86-font-utils
XFree86-libs
XFree86-libs-data
XFree86-sdk
XFree86-syriac-fonts
XFree86-tools
XFree86-truetype-fonts
XFree86-twm
XFree86-xauth
XFree86-xdm
XFree86-xfs

Upstream details at:
https://access.redhat.com/errata/RHSA-2007:0125

OSVersionArchitecturePackageVersionFilename
CentOS3i386xfree86-100dpi-fonts< 4.3.0-120.ELXFree86-100dpi-fonts-4.3.0-120.EL.i386.rpm
CentOS3i386xfree86< 4.3.0-120.ELXFree86-4.3.0-120.EL.i386.rpm
CentOS3i386xfree86-75dpi-fonts< 4.3.0-120.ELXFree86-75dpi-fonts-4.3.0-120.EL.i386.rpm
CentOS3i386xfree86-base-fonts< 4.3.0-120.ELXFree86-base-fonts-4.3.0-120.EL.i386.rpm
CentOS3i386xfree86-cyrillic-fonts< 4.3.0-120.ELXFree86-cyrillic-fonts-4.3.0-120.EL.i386.rpm
CentOS3i386xfree86-devel< 4.3.0-120.ELXFree86-devel-4.3.0-120.EL.i386.rpm
CentOS3i386xfree86-doc< 4.3.0-120.ELXFree86-doc-4.3.0-120.EL.i386.rpm
CentOS3i386xfree86-font-utils< 4.3.0-120.ELXFree86-font-utils-4.3.0-120.EL.i386.rpm
CentOS3i386xfree86-iso8859-14-100dpi-fonts< 4.3.0-120.ELXFree86-ISO8859-14-100dpi-fonts-4.3.0-120.EL.i386.rpm
CentOS3i386xfree86-iso8859-14-75dpi-fonts< 4.3.0-120.ELXFree86-ISO8859-14-75dpi-fonts-4.3.0-120.EL.i386.rpm
Rows per page:
1-10 of 1501

Related

openvas 55
nessus 63
suse 1
debian 4
redhat 6
osv 4
centos 4
ubuntu 3
gentoo 3
oraclelinux 6
securityvulns 5
vmware 1
prion 6
ubuntucve 6
fedora 4
altlinux 1
debiancve 6
cve 6
veracode 3
slackware 1
openvas
openvas
Mandriva Update for xorg-x11 MDKSA-2007:079 (xorg-x11)
2009-04-09 00:00:00
SuSE Update for XFree86, Xorg SUSE-SA:2007:027
2009-01-28 00:00:00
Mandriva Update for xorg-x11 MDKSA-2007:079-1 (xorg-x11)
2009-04-09 00:00:00
nessus
nessus
Mandrake Linux Security Advisory : xorg-x11 (MDKSA-2007:079-1)
2007-04-05 00:00:00
Oracle Linux 3 : XFree86 (ELSA-2007-0125)
2013-07-12 00:00:00
openSUSE 10 Security Update : xorg-x11-server (xorg-x11-server-3082)
2007-10-17 00:00:00
suse
suse
local privilege escalation in XFree86, Xorg
2007-04-20 16:38:35
debian
debian
[SECURITY] [DSA 1294-1] New xfree86 packages fix several vulnerabilities
2007-05-17 21:22:02
[SECURITY] [DSA 1454-1] New freetype packages fix arbitrary code execution
2008-01-07 19:48:32
[SECURITY] [DSA 1858-1] New imagemagick packages fix several vulnerabilities
2009-08-10 17:05:37
redhat
redhat
(RHSA-2007:0125) Important: XFree86 security update
2007-04-03 00:00:00
(RHSA-2007:0126) Important: xorg-x11 security update
2007-04-03 00:00:00
(RHSA-2007:0132) Important: libXfont security update
2007-04-03 00:00:00
osv
osv
xfree86
2007-05-17 00:00:00
freetype - arbitrary code execution
2008-01-07 00:00:00
imagemagick - several vulnerabilities
2009-08-10 00:00:00
centos
centos
XFree86 security update
2007-04-04 05:46:38
xorg security update
2007-04-04 00:24:46
freetype security update
2007-04-16 12:48:19
ubuntu
ubuntu
X.org vulnerabilities
2007-04-03 00:00:00
X.org vulnerability
2007-04-18 00:00:00
ImageMagick vulnerabilities
2007-07-10 00:00:00
gentoo
gentoo
LibXfont, TightVNC: Multiple vulnerabilities
2007-05-08 00:00:00
FreeType: User-assisted execution of arbitrary code
2007-05-01 00:00:00
X.Org X11 library: Multiple integer overflows
2007-05-05 00:00:00
oraclelinux
oraclelinux
Important: xorg-x11 security update
2007-04-04 00:00:00
Important: XFree86 security update
2007-04-04 00:00:00
Important: libXfont security update
2007-06-26 00:00:00
securityvulns
securityvulns
Multiple vulnerabilities in X.Org X11 server
2007-04-04 00:00:00
[Full-disclosure] iDefense Security Advisory 04.03.07: Multiple Vendor X Server fonts.dir File Parsing Integer Overflow Vulnerability
2007-04-04 00:00:00
[Full-disclosure] iDefense Security Advisory 04.03.07: Multiple Vendor X Server XC-MISC Extension Memory Corruption Vulnerability
2007-04-04 00:00:00
vmware
vmware
Updated Service Console packages (XFree86, UP and SMP kernels, Kerberos libraries) resolve security issues.
2007-07-05 00:00:00
prion
prion
Integer overflow
2007-04-06 01:19:00
Integer overflow
2007-04-06 01:19:00
Integer overflow
2007-04-06 01:19:00
ubuntucve
ubuntucve
CVE-2007-1352
2007-04-06 00:00:00
CVE-2007-1003
2007-04-06 00:00:00
CVE-2007-1351
2007-04-06 00:00:00
fedora
fedora
[SECURITY] Fedora Core 6 Update: xorg-x11-server-1.1.1-47.8.fc6
2007-04-10 16:49:47
[SECURITY] Fedora Core 5 Update: libX11-1.0.0-4.fc5
2007-04-10 16:52:48
[SECURITY] Fedora Core 6 Update: libX11-1.0.3-7.fc6
2007-04-10 16:51:20
altlinux
altlinux
Security fix for the ALT Linux 10 package xorg-server version 2:1.2.99.903-alt3
2007-04-03 00:00:00
debiancve
debiancve
CVE-2007-1003
2007-04-06 01:19:00
CVE-2007-1351
2007-04-06 01:19:00
CVE-2007-1352
2007-04-06 01:19:00
cve
cve
CVE-2007-1351
2007-04-06 01:19:00
CVE-2007-1352
2007-04-06 01:19:00
CVE-2007-1003
2007-04-06 01:19:00
veracode
veracode
Denial Of Service (DoS)
2020-04-10 00:15:13
Integer Overflow
2020-04-10 00:14:29
Information Disclosure
2020-04-10 00:13:16
slackware
slackware
[slackware-security] freetype
2007-04-20 02:55:00

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.05 Low

EPSS

Percentile

92.8%

JSON
Related for CESA-2007:0125
openvas55nessus63suse1debian4redhat6osv4centos4ubuntu3gentoo3oraclelinux6securityvulns5vmware1prion6ubuntucve6fedora4altlinux1debiancve6cve6veracode3slackware1