PT-2006-1086 · X.Org+2 · Xorg-Server+3

Published 2006-12-31 · Updated 2024-06-15 · CVE-2006-6103

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: xorg-server versions prior to 1.1.1-r4 X.Org versions 6.8.2, 6.9.0, 7.0, and 7.1

Description: The issue is related to multiple vulnerabilities in the xorg-server package, which can be exploited remotely, potentially leading to breaches of confidentiality, integrity, and availability of protected information. Specifically, an integer overflow in the ProcDbeSwapBuffers function in the DBE extension for X.Org allows local users to execute arbitrary code via a crafted X protocol request, triggering memory corruption during processing of unspecified data structures.

Recommendations: For xorg-server versions prior to 1.1.1-r4, update to version 1.1.1-r4 or later. For X.Org versions 6.8.2, 6.9.0, 7.0, and 7.1, consider disabling the DBE extension until a patch is available. As a temporary workaround, restrict access to the ProcDbeSwapBuffers function to minimize the risk of exploitation.

Fix

Related Identifiers

BDU:2015-09544

CVE-2006-6103

DSA-1249-1

HPSBUX02225

OPENSUSE-SU-2024:11525-1

RHSA-2007:0002

RHSA-2007:0003

RHSA-2007_0003

Affected Products

Hp-Ux

Red Hat

X.Org

Xorg-Server

References · 82

• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=465 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11525-1 · Vendor Advisory
• http://lists.freedesktop.org/archives/xorg-announce/2007-January/000235.html · Vendor Advisory
• https://debian.org/security/2007/dsa-1249 · Vendor Advisory
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-102803-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-6103 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6103 · Security Note
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01075678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-6103 · Security Note
• http://ubuntu.com/usn/usn-403-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2006-6103 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-6101 · Security Note
• http://redhat.com/support/errata/RHSA-2007-0002.html · Vendor Advisory
• http://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2007-002.txt.asc · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_08_x.html · Vendor Advisory