Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.

Updated X.org packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces such as GNOME and KDE are designed upon.

A buffer overflow flaw in the X.org server RENDER extension was discovered. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the X.org server. (CVE-2006-1526)

Users of X.org should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

This issue does not affect Red Hat Enterprise Linux 2.1 or 3.

The Render extension of the X.org server incorrectly calculated the size of a memory buffer, which led to a buffer overflow. A local attacker could exploit this to crash the X server or even execute arbitrary code with root privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A problem was discovered in xorg-x11 where the X render extension would mis-calculate the size of a buffer, leading to an overflow that could possibly be exploited by clients of the X server.

Update :

Rafael Bermudez noticed that the patch for 2006 was mis-applied. This update resolves that issue.

New xorg and xorg-devel packages are available for Slackware 10.1, 10.2, and -current to fix a security issue. A typo in the X render extension in X.Org 6.8.0 or later allows an X client to crash the server and possibly to execute arbitrary code as the X server user (typically this is 'root'.)

The remote host is affected by the vulnerability described in GLSA-200605-02 (X.Org: Buffer overflow in XRender extension)

    X.Org miscalculates the size of a buffer in the XRender extension.
  Impact :

    An X.Org user could exploit this issue to make the X server     execute arbitrary code with elevated privileges.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
21996	CentOS 4 : xorg-x11 (CESA-2006:0451)	Nessus	CentOS Local Security Checks	low
21374	Ubuntu 5.04 / 5.10 : xorg vulnerability (USN-280-1)	Nessus	Ubuntu Local Security Checks	low
21367	RHEL 4 : xorg-x11 (RHSA-2006:0451)	Nessus	Red Hat Local Security Checks	low
21356	Mandrake Linux Security Advisory : xorg-x11 (MDKSA-2006:081-1)	Nessus	Mandriva Local Security Checks	low
21342	Slackware 10.1 / 10.2 / current : xorg server overflow (SSA:2006-123-01)	Nessus	Slackware Local Security Checks	low
21317	GLSA-200605-02 : X.Org: Buffer overflow in XRender extension	Nessus	Gentoo Local Security Checks	low

Detections

Analytics

CVE-2006-1526

high

Tenable Plugins

low

low

low

low

low

low