PT-2003-2524 · Debian+1 · Xlibosmesa3+6

Published 1970-01-01 · Updated 2017-10-10 · CVE-2004-0094

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions XFree86 version 4.1.0 xlibosmesa3-dbg (affected versions not specified) xlib6g-dev (affected versions not specified) xfonts-pex (affected versions not specified) xlibosmesa3 (affected versions not specified) xlib6g (affected versions not specified)

Description The issue concerns multiple vulnerabilities in various packages of the Debian GNU/Linux operating system, including xlibosmesa3-dbg, xlib6g-dev, xfonts-pex, xlibosmesa3, and xlib6g. These vulnerabilities can be exploited remotely, potentially leading to a breach of confidentiality, integrity, and availability of protected information. Specifically, integer signedness errors in XFree86 4.1.0 can allow remote attackers to cause a denial of service and possibly execute arbitrary code when using the GLX extension and Direct Rendering Infrastructure (DRI).

Recommendations For XFree86 version 4.1.0, consider upgrading to a newer version to mitigate the risk. For xlibosmesa3-dbg, xlib6g-dev, xfonts-pex, xlibosmesa3, and xlib6g, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

BDU:2015-01798

BDU:2015-01799

BDU:2015-01800

BDU:2015-01801

BDU:2015-01802

CVE-2004-0094

DSA-443

Affected Products

Debian

Xfree86

Xfonts-Pex

Xlib6G

Xlib6G-Dev

Xlibosmesa3

Xlibosmesa3-Dbg

References · 19

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0083 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0093 · Security Note
• https://bdu.fstec.ru/vul/2015-01800 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2004-0094 · Security Note
• https://bdu.fstec.ru/vul/2015-01799 · Security Note
• https://bdu.fstec.ru/vul/2015-01801 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0106 · Security Note
• ftp://patches.sgi.com/support/free/security/advisories/20040406-01-U · Vendor Advisory
• http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000824 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2004-152.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01802 · Security Note
• https://bdu.fstec.ru/vul/2015-01798 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0690 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0084 · Security Note
• http://debian.org/security/2004/dsa-443 · Vendor Advisory