Multiple integer overflows in X.org libGLX in Mesa 9.1.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XF86DRIOpenConnection and (2) XF86DRIGetClientDriverName functions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mesa | Mesa3d | * | 9.1.1 (including) |
| Mesa | Mesa3d | 9.0 (including) | 9.0 (including) |
| Mesa | Mesa3d | 9.0.1 (including) | 9.0.1 (including) |
| Mesa | Mesa3d | 9.0.2 (including) | 9.0.2 (including) |
| Mesa | Mesa3d | 9.0.3 (including) | 9.0.3 (including) |
| Mesa | Mesa3d | 9.1 (including) | 9.1 (including) |
| Libglx | X | - (including) | - (including) |
| Red Hat Enterprise Linux 5 | RedHat | mesa-0:6.5.1-7.11.el5_9 | * |
| Red Hat Enterprise Linux 6 | RedHat | mesa-0:9.0-0.8.el6_4.3 | * |
| Mesa | Ubuntu | devel | * |
| Mesa | Ubuntu | lucid | * |
| Mesa | Ubuntu | precise | * |
| Mesa | Ubuntu | quantal | * |
| Mesa | Ubuntu | raring | * |
| Mesa | Ubuntu | upstream | * |