CVE-2013-7439

Multiple off-by-one errors in the (1) MakeBigReq and (2) SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11 before 1.6.0 allow remote attackers to have unspecified impact via a crafted request, which triggers a buffer overflow.

Affected Software

Name	Vendor	Start Version	End Version
Libx11	X.org	1.0.1 (including)	1.0.1 (including)
Libx11	X.org	1.0.2 (including)	1.0.2 (including)
Libx11	X.org	1.0.3 (including)	1.0.3 (including)
Libx11	X.org	1.1 (including)	1.1 (including)
Libx11	X.org	1.1-rc1 (including)	1.1-rc1 (including)
Libx11	X.org	1.1-rc2 (including)	1.1-rc2 (including)
Libx11	X.org	1.1.4 (including)	1.1.4 (including)
Libx11	X.org	1.1.5 (including)	1.1.5 (including)
Libx11	X.org	1.1.6 (including)	1.1.6 (including)
Libx11	X.org	1.1.99.1 (including)	1.1.99.1 (including)
Libx11	X.org	1.1.99.2 (including)	1.1.99.2 (including)
Libx11	X.org	1.2 (including)	1.2 (including)
Libx11	X.org	1.2.1 (including)	1.2.1 (including)
Libx11	X.org	1.2.2 (including)	1.2.2 (including)
Libx11	X.org	1.3 (including)	1.3 (including)
Libx11	X.org	1.3.1 (including)	1.3.1 (including)
Libx11	X.org	1.3.2 (including)	1.3.2 (including)
Libx11	X.org	1.3.3 (including)	1.3.3 (including)
Libx11	X.org	1.3.4 (including)	1.3.4 (including)
Libx11	X.org	1.3.5 (including)	1.3.5 (including)
Libx11	X.org	1.3.6 (including)	1.3.6 (including)
Libx11	X.org	1.3.99.901 (including)	1.3.99.901 (including)
Libx11	X.org	1.3.99.902 (including)	1.3.99.902 (including)
Libx11	X.org	1.3.99.903 (including)	1.3.99.903 (including)
Libx11	X.org	1.4.0 (including)	1.4.0 (including)
Libx11	X.org	1.4.1 (including)	1.4.1 (including)
Libx11	X.org	1.4.2 (including)	1.4.2 (including)
Libx11	X.org	1.4.3 (including)	1.4.3 (including)
Libx11	X.org	1.4.4 (including)	1.4.4 (including)
Libx11	X.org	1.4.99.901 (including)	1.4.99.901 (including)
Libx11	X.org	1.4.99.902 (including)	1.4.99.902 (including)
Libx11	X.org	1.5.0 (including)	1.5.0 (including)
Libx11	X.org	1.5.99.901 (including)	1.5.99.901 (including)
Libx11	X.org	1.5.99.902 (including)	1.5.99.902 (including)
Red Hat Enterprise Linux 6	RedHat	libdmx-0:1.1.3-3.el6	*
Red Hat Enterprise Linux 6	RedHat	libX11-0:1.6.0-2.2.el6	*
Red Hat Enterprise Linux 6	RedHat	libxcb-0:1.9.1-2.el6	*
Red Hat Enterprise Linux 6	RedHat	libXcursor-0:1.1.14-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXext-0:1.3.2-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXfixes-0:5.0.1-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXi-0:1.7.2-2.2.el6	*
Red Hat Enterprise Linux 6	RedHat	libXinerama-0:1.1.3-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXp-0:1.0.2-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXrandr-0:1.4.1-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXrender-0:0.9.8-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXres-0:1.0.7-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXt-0:1.1.4-6.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXtst-0:1.2.2-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXv-0:1.0.9-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXvMC-0:1.0.8-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXxf86dga-0:1.1.4-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	libXxf86vm-0:1.1.3-2.1.el6	*
Red Hat Enterprise Linux 6	RedHat	xcb-proto-0:1.8-3.el6	*
Red Hat Enterprise Linux 6	RedHat	xkeyboard-config-0:2.11-1.el6	*
Red Hat Enterprise Linux 6	RedHat	xorg-x11-proto-devel-0:7.7-9.el6	*
Red Hat Enterprise Linux 6	RedHat	xorg-x11-xtrans-devel-0:1.3.4-1.el6	*
Libx11	Ubuntu	lucid	*
Libx11	Ubuntu	precise	*
Libxrender	Ubuntu	devel	*
Libxrender	Ubuntu	esm-infra-legacy/trusty	*
Libxrender	Ubuntu	lucid	*
Libxrender	Ubuntu	precise	*
Libxrender	Ubuntu	trusty	*
Libxrender	Ubuntu	trusty/esm	*
Libxrender	Ubuntu	utopic	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2013-7439
CWE	https://cwe.mitre.org/data/definitions/189.html

Affected Software

References