Debian DSA-1249-1 : xfree86 - several vulnerabilities

critical Nessus Plugin ID 24026

Synopsis

The remote Debian host is missing a security-related update.

Description

Several vulnerabilities have been discovered in the X Window System, which may lead to privilege escalation or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

- CVE-2006-6101 Sean Larsson discovered an integer overflow in the Render extension, which might lead to denial of service or local privilege escalation.

- CVE-2006-6102 Sean Larsson discovered an integer overflow in the DBE extension, which might lead to denial of service or local privilege escalation.

- CVE-2006-6103 Sean Larsson discovered an integer overflow in the DBE extension, which might lead to denial of service or local privilege escalation.

Solution

Upgrade the XFree86 packages.

For the stable distribution (sarge) these problems have been fixed in version 4.3.0.dfsg.1-14sarge3. This update lacks builds for the Motorola 680x0 architecture, which had build problems. Packages will be released once this problem has been resolved.

For the upcoming stable distribution (etch) these problems have been fixed in version 2:1.1.1-15 of xorg-server.

Plugin Details

Severity: Critical

ID: 24026

File Name: debian_DSA-1249.nasl

Version: 1.16

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 1/17/2007

Updated: 1/4/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:xfree86, cpe:/o:debian:debian_linux:3.1

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 1/15/2007

Reference Information

CVE: CVE-2006-6101, CVE-2006-6102, CVE-2006-6103

DSA: 1249

Detections

Analytics