Integer overflow in the ProcRenderAddGlyphs function in the Render extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of glyph management data structures.

From Red Hat Security Advisory 2007:0003 :

Updated X.org packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

iDefense reported three integer overflow flaws in the X.org Render and DBE extensions. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the X.org server. (CVE-2006-6101, CVE-2006-6102, CVE-2006-6103)

Users of X.org should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

From Red Hat Security Advisory 2007:0002 :

Updated XFree86 packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

XFree86 is an implementation of the X Window System, which provides the core functionality for the Linux graphical desktop.

iDefense reported three integer overflow flaws in the XFree86 Render and DBE extensions. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the XFree86 server.
(CVE-2006-6101, CVE-2006-6102, CVE-2006-6103)

Users of XFree86 should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

X server: ProcRenderAddGlyphs Memory Corruption Vulnerability. This update fixes a memory corruption in the ProcRenderAddGlyphs() function (CVE-2006-6101). X server: ProcDbeGetVisualInfo Memory Corruption Vulnerability. This update fixes a memory corruption in the ProcDbeGetVisualInfo() function (CVE-2006-6102). X server:
ProcDbeSwapBuffers Memory Corruption Vulnerability. This update fixes a memory corruption in the ProcDbeSwapBuffers() function.
(CVE-2006-6103)

The DBE and Render extensions in X.org were vulnerable to integer overflows, which could lead to memory overwrites. An authenticated user could make a specially crafted request and execute arbitrary code with root privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes memory corruptions in the ProcRenderAddGlyphs()/ ProcDbeGetVisualInfo()/ProcDbeSwapBuffers() functions (CVE-2006-6101/ CVE-2006-6102/CVE-2006-6103).

s700_800 11.23 Xserver cumulative patch : 

Potential security vulnerabilities have been identified with HP-UX running Xserver. These vulnerabilities could be exploited by a local user to create a Denial of Service (DoS).

s700_800 11.31 Xserver cumulative patch : 

Potential security vulnerabilities have been identified with HP-UX running Xserver. These vulnerabilities could be exploited by a local user to create a Denial of Service (DoS).

s700_800 11.11 Xserver cumulative patch : 

Potential security vulnerabilities have been identified with HP-UX running Xserver. These vulnerabilities could be exploited by a local user to create a Denial of Service (DoS).

New x11 packages are available for Slackware 10.2 and 11.0.

Sean Larsson of iDefense Labs discovered several vulnerabilities in X.Org/XFree86 :

Local exploitation of a memory corruption vulnerability in the 'ProcRenderAddGlyphs()' function in the X.Org and XFree86 X server could allow an attacker to execute arbitrary code with privileges of the X server, typically root. (CVE-2006-6101)

Local exploitation of a memory corruption vulnerability in the 'ProcDbeGetVisualInfo()' function in the X.Org and XFree86 X server could allow an attacker to execute arbitrary code with privileges of the X server, typically root. (CVE-2006-6102)

Local exploitation of a memory corruption vulnerability in the 'ProcDbeSwapBuffers()' function in the X.Org and XFree86 X server could allow an attacker to execute arbitrary code with privileges of the X server, typically root. (CVE-2006-6103)

Updated packages are patched to address these issues.

The remote host is affected by the vulnerability described in GLSA-200701-25 (X.Org X server: Multiple vulnerabilities)

    Multiple memory corruption vulnerabilities have been found in the     ProcDbeGetVisualInfo() and the ProcDbeSwapBuffers() of the DBE     extension, and ProcRenderAddGlyphs() in the Render extension.
  Impact :

    A local attacker could execute arbitrary code with the privileges of     the user running the X server, typically root.
  Workaround :

    Disable the DBE extension by removing the 'Load dbe' directive in the     Module section of xorg.conf, and explicitly disable the Render     extension with ' Option 'RENDER' 'disable' ' in the Extensions section.
    Note: This could affect the functionality of some applications.

Several vulnerabilities have been discovered in the X Window System, which may lead to privilege escalation or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-6101     Sean Larsson discovered an integer overflow in the     Render extension, which might lead to denial of service     or local privilege escalation.

  - CVE-2006-6102     Sean Larsson discovered an integer overflow in the DBE     extension, which might lead to denial of service or     local privilege escalation.

  - CVE-2006-6103     Sean Larsson discovered an integer overflow in the DBE     extension, which might lead to denial of service or     local privilege escalation.

Updated X.org packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

iDefense reported three integer overflow flaws in the X.org Render and DBE extensions. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the X.org server. (CVE-2006-6101, CVE-2006-6102, CVE-2006-6103)

Users of X.org should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

Updated XFree86 packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1 and 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

XFree86 is an implementation of the X Window System, which provides the core functionality for the Linux graphical desktop.

iDefense reported three integer overflow flaws in the XFree86 Render and DBE extensions. A malicious authorized client could exploit this issue to cause a denial of service (crash) or potentially execute arbitrary code with root privileges on the XFree86 server.
(CVE-2006-6101, CVE-2006-6102, CVE-2006-6103)

Users of XFree86 should upgrade to these updated packages, which contain a backported patch and is not vulnerable to this issue.

ID	Name	Product	Family	Severity
67435	Oracle Linux 4 : xorg-x11 (ELSA-2007-0003)	Nessus	Oracle Linux Local Security Checks	critical
67434	Oracle Linux 3 : XFree86 (ELSA-2007-0002)	Nessus	Oracle Linux Local Security Checks	critical
29606	SuSE 10 Security Update : xorg-x11-server (ZYPP Patch Number 2449)	Nessus	SuSE Local Security Checks	critical
27991	Ubuntu 5.10 / 6.06 LTS / 6.10 : xorg, xorg-server vulnerabilities (USN-403-1)	Nessus	Ubuntu Local Security Checks	critical
27495	openSUSE 10 Security Update : xorg-x11-server (xorg-x11-server-2453)	Nessus	SuSE Local Security Checks	critical
26156	HP-UX PHSS_36452 : HP-UX Running Xserver, Local Denial of Service (DoS) (HPSBUX02225 SSRT071295 rev.1)	Nessus	HP-UX Local Security Checks	critical
26150	HP-UX PHSS_36123 : HP-UX Running Xserver, Local Denial of Service (DoS) (HPSBUX02225 SSRT071295 rev.1)	Nessus	HP-UX Local Security Checks	critical
26141	HP-UX PHSS_34389 : HP-UX Running Xserver, Local Denial of Service (DoS) (HPSBUX02225 SSRT071295 rev.1)	Nessus	HP-UX Local Security Checks	critical
24788	Slackware 10.2 / 11.0 : x11 (SSA:2007-066-02)	Nessus	Slackware Local Security Checks	critical
24621	Mandrake Linux Security Advisory : xorg-x11 (MDKSA-2007:005)	Nessus	Mandriva Local Security Checks	critical
24310	GLSA-200701-25 : X.Org X server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
24026	Debian DSA-1249-1 : xfree86 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
24023	CentOS 4 : xorg-x11 (CESA-2007:0003)	Nessus	CentOS Local Security Checks	critical
24010	RHEL 4 : xorg-x11 (RHSA-2007:0003)	Nessus	Red Hat Local Security Checks	critical
24009	RHEL 2.1 / 3 : XFree86 (RHSA-2007:0002)	Nessus	Red Hat Local Security Checks	critical
24005	CentOS 3 : XFree86 (CESA-2007:0002)	Nessus	CentOS Local Security Checks	critical

Detections

Analytics

CVE-2006-6101

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical