Buffer overflow in the compNewPixmap function in compalloc.c in the Composite extension for the X.org X11 server before 1.4 allows local users to execute arbitrary code by copying data from a large pixel depth pixmap into a smaller pixel depth pixmap.

From Red Hat Security Advisory 2007:0898 :

Updated X.org packages that correct a flaw in X.Org's composite extension are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way X.Org's composite extension handles 32 bit color depth windows while running in 16 bit color depth mode. If an X.org server has enabled the composite extension, it may be possible for a malicious authorized client to cause a denial of service (crash) or potentially execute arbitrary code with the privileges of the X.org server. (CVE-2007-4730)

Please note this flaw can only be triggered when using a compositing window manager. Red Hat Enterprise Linux 4 does not ship with a compositing window manager.

Users of X.org should upgrade to these updated packages, which contain a backported patch and are not vulnerable to these issues.

A flaw was found in the way X.Org's composite extension handles 32 bit color depth windows while running in 16 bit color depth mode. If an X.org server has enabled the composite extension, it may be possible for a malicious authorized client to cause a denial of service (crash) or potentially execute arbitrary code with the privileges of the X.org server. (CVE-2007-4730)

Please note this flaw can only be triggered when using a compositing window manager. Scientific Linux 4 does not ship with a compositing window manager.

This update fixes the following issues :

X Font Server build_range() Integer Overflow Vulnerability [IDEF2708] (CVE-2007-4989), X Font Server swap_char2b() Heap Overflow Vulnerability [IDEF2709] (CVE-2007-4990), Composite extension buffer overflow. (CVE-2007-4730)

Aaron Plattner discovered that the Composite extension did not correctly calculate the size of buffers when copying between different bit depths. An authenticated user could exploit this to execute arbitrary code with root privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-200710-16 (X.Org X server: Composite local privilege escalation)

    Aaron Plattner discovered a buffer overflow in the compNewPixmap()     function when copying data from a large pixel depth pixmap into a     smaller pixel depth pixmap.
  Impact :

    A local attacker could execute arbitrary code with the privileges of     the user running the X server, typically root.
  Workaround :

    Disable the Composite extension by setting ' Option 'Composite'     'disable' ' in the Extensions section of xorg.conf.
    Note: This could affect the functionality of some applications.

Updated X.org packages that correct a flaw in X.Org's composite extension are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

X.org is an open source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user interfaces are designed upon.

A flaw was found in the way X.Org's composite extension handles 32 bit color depth windows while running in 16 bit color depth mode. If an X.org server has enabled the composite extension, it may be possible for a malicious authorized client to cause a denial of service (crash) or potentially execute arbitrary code with the privileges of the X.org server. (CVE-2007-4730)

Please note this flaw can only be triggered when using a compositing window manager. Red Hat Enterprise Linux 4 does not ship with a compositing window manager.

Users of X.org should upgrade to these updated packages, which contain a backported patch and are not vulnerable to these issues.

Aaron Plattner discovered a buffer overflow in the Composite extension of the X.org X server, which if exploited could lead to local privilege escalation.

Updated packages have been patched to prevent these issues.

Aaron Plattner discovered a buffer overflow in the Composite extension of the X.org X server, which can lead to local privilege escalation.

The oldstable distribution (sarge) is not affected by this problem.

ID	Name	Product	Family	Severity
67572	Oracle Linux 4 : xorg-x11 (ELSA-2007-0898)	Nessus	Oracle Linux Local Security Checks	medium
60254	Scientific Linux Security Update : xorg-x11 on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
29603	SuSE 10 Security Update : X.org X11 (ZYPP Patch Number 4485)	Nessus	SuSE Local Security Checks	high
28119	Ubuntu 6.06 LTS : xorg-server vulnerability (USN-514-1)	Nessus	Ubuntu Local Security Checks	medium
27051	GLSA-200710-16 : X.Org X server: Composite local privilege escalation	Nessus	Gentoo Local Security Checks	medium
26111	RHEL 4 : xorg-x11 (RHSA-2007:0898)	Nessus	Red Hat Local Security Checks	medium
26076	CentOS 4 : xorg-x11 (CESA-2007:0898)	Nessus	CentOS Local Security Checks	medium
26045	Mandrake Linux Security Advisory : x11-server (MDKSA-2007:178)	Nessus	Mandriva Local Security Checks	medium
26033	Debian DSA-1372-1 : xorg-server - buffer overflow	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2007-4730

critical

Tenable Plugins

medium

medium

high

medium

medium

medium

medium

medium

medium