iDefense Security Advisory 06.11.08: Multiple Vendor X Server Render Extension AllocateGlyph() Integer Overflow Vulnerability

iDefense Security Advisory 06.11.08 http://labs.idefense.com/intelligence/vulnerabilities/ Jun 11, 2008 I. BACKGROUND The X Window System is a graphical windowing system based on a client/server model. The Render extension is used to provide Porter-Duff image compositing for the X server. It is...

RHEL 4 : xorg-x11 (RHSA-2008:0503)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0503 advisory. - X.org Record and Security extensions memory corruption CVE-2008-1377 - X.org MIT-SHM extension arbitrary memory read CVE-2008-1379 - X.org...

SuSE 10 Security Update : X.org (ZYPP Patch Number 5321)

This update fixes multiple vulnerabilities reported by iDefense : - RENDER Extension heap buffer overflow. CVE-2008-2360 - RENDER Extension crash. CVE-2008-2361 - RENDER Extension memory corruption. CVE-2008-2362 - MIT-SHM arbitrary memory read. CVE-2008-1379 - RECORD and Security extensions memo...

openSUSE 10 Security Update : xorg-x11-server (xorg-x11-server-5316)

This update fixes multiple vulnerabilities reported by iDefense : - CVE-2008-2360 - RENDER Extension heap buffer overflow - CVE-2008-2361 - RENDER Extension crash - CVE-2008-2362 - RENDER Extension memory corruption - CVE-2008-1379 - MIT-SHM arbitrary memory read - CVE-2008-1377 - RECORD and...

X.org Render extension AllocateGlyph() heap buffer overflow

Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that are used to calculate a heap buffer size, which triggers a heap-based buffer overflow...

X.org Render extension input validation flaw causing memory corruption

Multiple integer overflows in the Render extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via a 1 SProcRenderCreateLinearGradient, 2 SProcRenderCreateRadialGradient, or 3 SProcRenderCreateConicalGradient request with an invalid field...

X.org Render extension ProcRenderCreateCursor() crash

Integer overflow in the ProcRenderCreateCursor function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to cause a denial of service daemon crash via unspecified request fields that are used to calculate a glyph buffer size, which triggers a...

X.org Render extension AllocateGlyph() heap buffer overflow

Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that are used to calculate a heap buffer size, which triggers a heap-based buffer overflow...

X.org Render extension AllocateGlyph() heap buffer overflow

Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that are used to calculate a heap buffer size, which triggers a heap-based buffer overflow...

X.org Render extension ProcRenderCreateCursor() crash

Integer overflow in the ProcRenderCreateCursor function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to cause a denial of service daemon crash via unspecified request fields that are used to calculate a glyph buffer size, which triggers a...

X.org Render extension AllocateGlyph() heap buffer overflow

Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that are used to calculate a heap buffer size, which triggers a heap-based buffer overflow...

X.org Render extension ProcRenderCreateCursor() crash

Integer overflow in the ProcRenderCreateCursor function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to cause a denial of service daemon crash via unspecified request fields that are used to calculate a glyph buffer size, which triggers a...

xorg-x11-server security update

1.1.1-48.41.0.1.el52.1 - Added Enterprise Linux detection 1.1.1-48.41.1 - cve-2008-1377.patch: Record and Security Extension Input validation - cve-2008-1379.patch: MIT-SHM extension Input Validation flaw - cve-2008-2360.patch: Render AllocateGlyph extension Integer overflows - cve-2008-2361.patc...

Power Phlogger 2.2.x - Cross-Site Scripting

Power Phlogger 2.2.x - Cross-Site Scripting source: https://www.securityfocus.com/bid/37150/info Power Phlogger is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. Attackers can exploit this issue to steal cookie-based...

Design/Logic Flaw

The cmdjob utility in Autodesk Backburner 3.0.2 allows remote attackers to execute arbitrary commands on render servers by queueing jobs that contain these commands. NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the...

CVE-2007-4749

The cmdjob utility in Autodesk Backburner 3.0.2 allows remote attackers to execute arbitrary commands on render servers by queueing jobs that contain these commands. NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the...

XSS Bug in printable link display

A Cross sites scripting vulnerability exists in macro used to render the 'printable' link. Here is an exploit for the vulnerability that works https://servername/wiki/display/a/2007/09/%22%3E%3Cscript%3Ealert'Watchfire%20XSS%20Test%20Successful'%3C/script%3E Bug was found using APPScan...

XSS Bug in printable link display

A Cross sites scripting vulnerability exists in macro used to render the 'printable' link. Here is an exploit for the vulnerability that works https://servername/wiki/display/a/2007/09/%22%3E%3Cscript%3Ealert'Watchfire%20XSS%20Test%20Successful'%3C/script%3E Bug was found using APPScan...

CVE-2007-2437

The X render Xrender extension in X.org X Window System 7.0, 7.1, and 7.2, with Xserver 1.3.0 and earlier, allows remote authenticated users to cause a denial of service daemon crash via crafted values to the 1 XRenderCompositeTrapezoids and 2 XRenderAddTraps functions, which trigger a...

DEBIAN-CVE-2007-2437

The X render Xrender extension in X.org X Window System 7.0, 7.1, and 7.2, with Xserver 1.3.0 and earlier, allows remote authenticated users to cause a denial of service daemon crash via crafted values to the 1 XRenderCompositeTrapezoids and 2 XRenderAddTraps functions, which trigger a...