Multiple integer overflows in X.org libXrandr 1.4.0 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRRQueryOutputProperty and (2) XRRQueryProviderProperty functions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libxrandr | X | * | 1.4.0 (including) |
| Libxrandr | X | 1.2.3 (including) | 1.2.3 (including) |
| Libxrandr | X | 1.2.99.1 (including) | 1.2.99.1 (including) |
| Libxrandr | X | 1.2.99.2 (including) | 1.2.99.2 (including) |
| Libxrandr | X | 1.2.99.3 (including) | 1.2.99.3 (including) |
| Libxrandr | X | 1.2.99.4 (including) | 1.2.99.4 (including) |
| Libxrandr | X | 1.3.0 (including) | 1.3.0 (including) |
| Libxrandr | X | 1.3.1 (including) | 1.3.1 (including) |
| Libxrandr | X | 1.3.2 (including) | 1.3.2 (including) |