Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent attackers to execute arbitrary code via (1) a GetVisualInfo request containing a 32-bit value that is improperly used to calculate an amount of memory for allocation by the EVI extension, or (2) a request containing values related to pixmap size that are improperly used in management of shared memory by the MIT-SHM extension.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Evi | X.org | * | * |
| Mit-shm | X.org | * | * |
| Xserver | X.org | * | 1.4 (including) |
| Red Hat Enterprise Linux 2.1 | RedHat | XFree86-0:4.1.0-86.EL | * |
| Red Hat Enterprise Linux 3 | RedHat | XFree86-0:4.3.0-126.EL | * |
| Red Hat Enterprise Linux 4 | RedHat | xorg-x11-0:6.8.2-1.EL.33.0.2 | * |
| Red Hat Enterprise Linux 5 | RedHat | xorg-x11-server-0:1.1.1-48.26.el5_1.5 | * |
| Xorg-server | Ubuntu | dapper | * |
| Xorg-server | Ubuntu | devel | * |
| Xorg-server | Ubuntu | edgy | * |
| Xorg-server | Ubuntu | feisty | * |
| Xorg-server | Ubuntu | gutsy | * |
| Xorg-server | Ubuntu | upstream | * |