The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data.
http://www.securitytracker.com/id/1036945
http://www.securityfocus.com/bid/93368