Mandriva Linux Security Advisory : metisse (MDVSA-2008:179)

critical Nessus Plugin ID 36890

Synopsis

The remote Mandriva Linux host is missing one or more security updates.

Description

An input validation flaw was found in X.org's MIT-SHM extension. A client connected to the X.org server could read arbitrary server memory, resulting in the disclosure of sensitive data of other users of the X.org server (CVE-2008-1379).

Multiple integer overflows were found in X.org's Render extension. A malicious authorized client could exploit these issues to cause a denial of service (crash) or possibly execute arbitrary code with root privileges on the X.org server (CVE-2008-2360, CVE-2008-2361, CVE-2008-2362).

The Metisse program is likewise affected by these issues; the updated packages have been patched to prevent them.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 36890

File Name: mandriva_MDVSA-2008-179.nasl

Version: 1.17

Type: local

Family: Mandriva Local Security Checks

Published: 4/23/2009

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64metisse1, p-cpe:/a:mandriva:linux:lib64metisse1-devel, p-cpe:/a:mandriva:linux:libmetisse1, p-cpe:/a:mandriva:linux:libmetisse1-devel, p-cpe:/a:mandriva:linux:metisse, p-cpe:/a:mandriva:linux:metisse-fvwm, p-cpe:/a:mandriva:linux:x11-server-xmetisse, cpe:/o:mandriva:linux:2008.0, cpe:/o:mandriva:linux:2008.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 8/21/2008

Reference Information

CVE: CVE-2008-1379, CVE-2008-2360, CVE-2008-2361, CVE-2008-2362

BID: 29665, 29668, 29669, 29670

CWE: 189

MDVSA: 2008:179

Detections

Analytics