remote code execution in Xorg and XFree

The X windows system is vulnerable to several kind of vulner- abilities that are caused due to insufficient input validation. The bugs range from crashing the X server to executing arbitrary code with the privilges of the X server process. For a successful attack the opponent needs shell access to the vulnerable system (local) or an already established connection to the X server. Thanks to US CERT and iDefense for reporting this vulnerabilities and to the Xorg-Security folks for fixing it. The Fixes are: - CVE-2007-5760: XFree86 Misc extension out of bounds array index - CVE-2007-5958: File existence disclosure - CVE-2007-6427: Xinput extension memory corruption - CVE-2007-6428: TOG-cup extension memory corruption - CVE-2007-6429: MIT-SHM and EVI extensions integer overflows - CVE-2008-0006: PCF Font parser buffer overflow

Solution

none