Multiple integer overflows in X.org libXext 1.3.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XcupGetReservedColormapEntries, (2) XcupStoreColors, (3) XdbeGetVisualInfo, (4) XeviGetVisualInfo, (5) XShapeGetRectangles, and (6) XSyncListSystemCounters functions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libxext | X | * | 1.3.1 (including) |
| Libxext | X | 1.0.99.2 (including) | 1.0.99.2 (including) |
| Libxext | X | 1.0.99.3 (including) | 1.0.99.3 (including) |
| Libxext | X | 1.0.99.4 (including) | 1.0.99.4 (including) |
| Libxext | X | 1.1 (including) | 1.1 (including) |
| Libxext | X | 1.1.1 (including) | 1.1.1 (including) |
| Libxext | X | 1.1.2 (including) | 1.1.2 (including) |
| Libxext | X | 1.2.0 (including) | 1.2.0 (including) |
| Libxext | X | 1.3.0 (including) | 1.3.0 (including) |