PT-2006-1084 · X.Org+2 · Xorg-Server+3

Published 2006-12-31 · Updated 2024-06-15 · CVE-2006-6101

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: xorg-server versions prior to 1.1.1-r4 X.Org versions 6.8.2, 6.9.0, 7.0, and 7.1

Description: The issue is related to multiple vulnerabilities in the xorg-server package, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, an integer overflow in the ProcRenderAddGlyphs function in the Render extension for X.Org can allow local users to execute arbitrary code via a crafted X protocol request, triggering memory corruption during the processing of glyph management data structures.

Recommendations: For xorg-server versions prior to 1.1.1-r4, update to version 1.1.1-r4 or later. For X.Org versions 6.8.2, 6.9.0, 7.0, and 7.1, consider disabling the Render extension until a patch is available. As a temporary workaround, restrict access to the ProcRenderAddGlyphs function to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09544

CVE-2006-6101

DSA-1249-1

HPSBUX02225

OPENSUSE-SU-2024:11525-1

RHSA-2007:0002

RHSA-2007:0003

RHSA-2007_0003

Affected Products

Hp-Ux

Red Hat

X.Org

Xorg-Server

References · 82

• https://osv.dev/vulnerability/openSUSE-SU-2024:11525-1 · Vendor Advisory
• http://lists.freedesktop.org/archives/xorg-announce/2007-January/000235.html · Vendor Advisory
• https://debian.org/security/2007/dsa-1249 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102803-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-6101 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6103 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-6101 · Vendor Advisory
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01075678 · Vendor Advisory
• http://ubuntu.com/usn/usn-403-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6101 · Security Note
• http://redhat.com/support/errata/RHSA-2007-0002.html · Vendor Advisory
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-002.txt.asc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6101 · Security Note
• http://novell.com/linux/security/advisories/2007_08_x.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09544 · Security Note