xorg server overflow (SSA:2006-123-01)
Posted on: 05/03/2006 07:07 PM
New xorg and xorg-devel packages are available for Slackware 10.1, 10.2, and -current to fix a security issue. A typo in the X render extension in X.Org 6.8.0 or later allows an X client to crash the server and possibly to execute arbitrary code as the X server user (typically this is "root".)
More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:
Here are the details from the Slackware 10.2 ChangeLog: +--------------------------+ patches/packages/x11-6.8.2-i486-5.tgz: Patched with x11r6.9.0-mitri.diff and recompiled. A typo in the X render extension allows an X client to crash the server and possibly to execute arbitrary code as the X server user (typically this is "root".) The CVE entry for this issue may be found here: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1526 The advisory from X.Org may be found here: http://lists.freedesktop.org/archives/xorg/2006-May/015136.html (* Security fix *) patches/packages/x11-devel-6.8.2-i486-5.tgz: Patched and recompiled libXrender. (* Security fix *) +--------------------------+
Where to find the new packages: +-----------------------------+