This update fixes multiple vulnerabilities reported by iDefense :

  - CVE-2008-2360 - RENDER Extension heap buffer overflow

  - CVE-2008-2361 - RENDER Extension crash

  - CVE-2008-2362 - RENDER Extension memory corruption 

  - CVE-2008-1379 - MIT-SHM arbitrary memory read

  - CVE-2008-1377 - RECORD and Security extensions memory     corruption Additionally fixes for :

  - gnome-screensaver loses keyboard focus lock under compiz     (CVE-2007-3920)

For further details, see X.org security advisory:
http://lists.freedesktop.org/archives/xorg/2008-June/036026.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matthieu Herrb of X.Org reports :

Several vulnerabilities have been found in the server-side code of some extensions in the X Window System. Improper validation of client-provided data can cause data corruption.

Exploiting these overflows will crash the X server or, under certain circumstances allow the execution of arbitrary machine code.

When the X server is running with root privileges (which is the case for the Xorg server and for most kdrive based servers), these vulnerabilities can thus also be used to raise privileges.

All these vulnerabilities, to be exploited successfully, require either an already established connection to a running X server (and normally running X servers are only accepting authenticated connections), or a shell access with a valid user on the machine where the vulnerable server is installed.

New xorg-server packages are available for Slackware 12.1 and
-current to fix security issues in xorg-server 1.4 prior to version 1.4.2.

This update fixes multiple vulnerabilities reported by iDefense for the included X server :

  - CVE-2008-2360 - RENDER Extension heap buffer overflow

  - CVE-2008-2361 - RENDER Extension crash

  - CVE-2008-2362 - RENDER Extension memory corruption 

  - CVE-2008-1379 - MIT-SHM arbitrary memory read

  - CVE-2008-1377 - RECORD and Security extensions memory     corruption

An input validation flaw was discovered in X.org's Security and Record extensions. A malicious authorized client could exploit this issue to cause a denial of service (crash) or, potentially, execute arbitrary code with root privileges on the X.Org server. (CVE-2008-1377)

Multiple integer overflow flaws were found in X.org's Render extension. A malicious authorized client could exploit these issues to cause a denial of service (crash) or, potentially, execute arbitrary code with root privileges on the X.Org server. (CVE-2008-2360, CVE-2008-2361, CVE-2008-2362)

An input validation flaw was discovered in X.org's MIT-SHM extension.
A client connected to the X.org server could read arbitrary server memory. This could result in the sensitive data of other users of the X.org server being disclosed. (CVE-2008-1379)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
33166	openSUSE 10 Security Update : xorg-x11-server (xorg-x11-server-5316)	Nessus	SuSE Local Security Checks	2008/6/12	2021/1/14	critical
33180	Fedora 8 : xorg-x11-server-1.3.0.0-46.fc8 (2008-5279)	Nessus	Fedora Local Security Checks	2008/6/16	2021/1/11	critical
33181	Fedora 7 : xorg-x11-server-1.3.0.0-17.fc7 (2008-5285)	Nessus	Fedora Local Security Checks	2008/6/16	2021/1/11	critical
33187	FreeBSD : xorg -- multiple vulnerabilities (800e8bd5-3acb-11dd-8842-001302a18722)	Nessus	FreeBSD Local Security Checks	2008/6/16	2021/1/6	critical
33398	Slackware 12.1 / current : xorg-server (SSA:2008-183-01)	Nessus	Slackware Local Security Checks	2008/7/8	2021/1/14	critical
40155	openSUSE Security Update : xgl (xgl-155)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	critical
60423	Scientific Linux Security Update : xorg-x11-server on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical