This update fixes multiple vulnerabilities reported by iDefense :

  - RENDER Extension heap buffer overflow. (CVE-2008-2360)

  - RENDER Extension crash. (CVE-2008-2361)

  - RENDER Extension memory corruption. (CVE-2008-2362)

  - MIT-SHM arbitrary memory read. (CVE-2008-1379)

  - RECORD and Security extensions memory corruption.
    (CVE-2008-1377)

This update fixes multiple vulnerabilities reported by iDefense :

  - CVE-2008-2360 - RENDER Extension heap buffer overflow

  - CVE-2008-2361 - RENDER Extension crash

  - CVE-2008-2362 - RENDER Extension memory corruption 

  - CVE-2008-1379 - MIT-SHM arbitrary memory read

  - CVE-2008-1377 - RECORD and Security extensions memory     corruption Additionally fixes for :

  - gnome-screensaver loses keyboard focus lock under compiz     (CVE-2007-3920)

For further details, see X.org security advisory:
http://lists.freedesktop.org/archives/xorg/2008-June/036026.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matthieu Herrb of X.Org reports :

Several vulnerabilities have been found in the server-side code of some extensions in the X Window System. Improper validation of client-provided data can cause data corruption.

Exploiting these overflows will crash the X server or, under certain circumstances allow the execution of arbitrary machine code.

When the X server is running with root privileges (which is the case for the Xorg server and for most kdrive based servers), these vulnerabilities can thus also be used to raise privileges.

All these vulnerabilities, to be exploited successfully, require either an already established connection to a running X server (and normally running X servers are only accepting authenticated connections), or a shell access with a valid user on the machine where the vulnerable server is installed.

New xorg-server packages are available for Slackware 12.1 and
-current to fix security issues in xorg-server 1.4 prior to version 1.4.2.

This update fixes multiple vulnerabilities reported by iDefense for the included X server :

  - CVE-2008-2360 - RENDER Extension heap buffer overflow

  - CVE-2008-2361 - RENDER Extension crash

  - CVE-2008-2362 - RENDER Extension memory corruption 

  - CVE-2008-1379 - MIT-SHM arbitrary memory read

  - CVE-2008-1377 - RECORD and Security extensions memory     corruption

ID	名前	製品	ファミリー	公開日	更新日	深刻度
33164	SuSE 10 Security Update : X.org (ZYPP Patch Number 5321)	Nessus	SuSE Local Security Checks	2008/6/12	2021/1/14	critical
33166	openSUSE 10 Security Update : xorg-x11-server (xorg-x11-server-5316)	Nessus	SuSE Local Security Checks	2008/6/12	2021/1/14	critical
33180	Fedora 8 : xorg-x11-server-1.3.0.0-46.fc8 (2008-5279)	Nessus	Fedora Local Security Checks	2008/6/16	2021/1/11	critical
33181	Fedora 7 : xorg-x11-server-1.3.0.0-17.fc7 (2008-5285)	Nessus	Fedora Local Security Checks	2008/6/16	2021/1/11	critical
33187	FreeBSD : xorg -- multiple vulnerabilities (800e8bd5-3acb-11dd-8842-001302a18722)	Nessus	FreeBSD Local Security Checks	2008/6/16	2021/1/6	critical
33398	Slackware 12.1 / current : xorg-server (SSA:2008-183-01)	Nessus	Slackware Local Security Checks	2008/7/8	2021/1/14	critical
40155	openSUSE Security Update : xgl (xgl-155)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	critical

検出

プラグインの検索

critical

critical

critical

critical

critical

critical

critical