This update fixes multiple vulnerabilities reported by iDefense :

  - RENDER Extension heap buffer overflow. (CVE-2008-2360)

  - RENDER Extension crash. (CVE-2008-2361)

  - RENDER Extension memory corruption . (CVE-2008-2362)

  - MIT-SHM arbitrary memory read. (CVE-2008-1379)

  - RECORD and Security extensions memory corruption.
    (CVE-2008-1377)

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2008-80:01 advisory.

    X.Org is an open source implementation of the X Window System. It provides basic low-level functionality     that full-fledged graphical user interfaces are designed upon.
    Bugs fixed:
    CVE-2008-1377     The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and     the (3) SProcSecurityGenerateAuthorization function in the Security extension in the X server 1.4 in X.Org     X11R7.3 allow context-dependent attackers to execute arbitrary code via requests with crafted length     values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap     corruption.
    CVE-2008-1379     Integer overflow in the fbShmPutImage function in the MIT-SHM extension in the X server 1.4 in X.Org     X11R7.3 allows context-dependent attackers to read arbitrary process memory via crafted values for a     Pixmap width and height.
    CVE-2008-2360     Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org     X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that     are used to calculate a heap buffer size, which triggers a heap-based buffer overflow.
    CVE-2008-2361     Integer overflow in the ProcRenderCreateCursor function in the Render extension in the X server 1.4 in     X.Org X11R7.3 allows context-dependent attackers to cause a denial of service (daemon crash) via     unspecified request fields that are used to calculate a glyph buffer size, which triggers a dereference of     unmapped memory.
    CVE-2008-2362     Multiple integer overflows in the Render extension in the X server 1.4 in X.Org X11R7.3 allow context-     dependent attackers to execute arbitrary code via a (1) SProcRenderCreateLinearGradient, (2)     SProcRenderCreateRadialGradient, or (3) SProcRenderCreateConicalGradient request with an invalid field     specifying the number of bytes to swap in the request data, which triggers heap memory corruption.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes multiple vulnerabilities reported by iDefense :

  - CVE-2008-2360 - RENDER Extension heap buffer overflow

  - CVE-2008-2361 - RENDER Extension crash

  - CVE-2008-2362 - RENDER Extension memory corruption 

  - CVE-2008-1379 - MIT-SHM arbitrary memory read

  - CVE-2008-1377 - RECORD and Security extensions memory     corruption Additionally fixes for :

  - XvReputImage crashes due to Nulled PortPriv->pDraw

  - gnome-screensaver loses keyboard focus lock under compiz     (CVE-2007-3920)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0504 advisory.

    [1.1.1-48.41.0.1.el5_2.1]
    - Added Enterprise Linux detection

    [1.1.1-48.41.1]
    - cve-2008-1377.patch: Record and Security Extension Input validation
    - cve-2008-1379.patch: MIT-SHM extension Input Validation flaw
    - cve-2008-2360.patch: Render AllocateGlyph extension Integer overflows
    - cve-2008-2361.patch: Render CreateCursor extension Integer overflows
    - cve-2008-2362.patch: Render Gradient extension Integer overflows

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An input validation flaw was discovered in X.org's Security and Record extensions. A malicious authorized client could exploit this issue to cause a denial of service (crash) or, potentially, execute arbitrary code with root privileges on the X.Org server. (CVE-2008-1377)

Multiple integer overflow flaws were found in X.org's Render extension. A malicious authorized client could exploit these issues to cause a denial of service (crash) or, potentially, execute arbitrary code with root privileges on the X.Org server. (CVE-2008-2360, CVE-2008-2361)

An input validation flaw was discovered in X.org's MIT-SHM extension.
A client connected to the X.org server could read arbitrary server memory. This could result in the sensitive data of other users of the X.org server being disclosed. (CVE-2008-1379)

s700_800 11.31 Xserver cumulative patch : 

Potential security vulnerabilities have been identified with HP-UX running Xserver. The vulnerabilities could be exploited remotely to execute arbitrary code.

This update fixes multiple vulnerabilities reported by iDefense for the included X server :

  - RENDER Extension heap buffer overflow. (CVE-2008-2360)

  - RENDER Extension crash. (CVE-2008-2361)

  - RENDER Extension memory corruption. (CVE-2008-2362)

  - MIT-SHM arbitrary memory read. (CVE-2008-1379)

  - RECORD and Security extensions memory corruption.
    (CVE-2008-1377)

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0503 advisory.

  - X.org Record and Security extensions memory corruption (CVE-2008-1377)

  - X.org MIT-SHM extension arbitrary memory read (CVE-2008-1379)

  - X.org Render extension AllocateGlyph() heap buffer overflow (CVE-2008-2360)

  - X.org Render extension ProcRenderCreateCursor() crash (CVE-2008-2361)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
41215	SuSE9 Security Update : XFree86 (YOU Patch Number 12170)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	critical
283986	MiracleLinux 3 : xorg-x11-server-1.1.1-48.26.5.3AXS3 (AXSA:2008-80:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	critical
33165	openSUSE 10 Security Update : xorg-x11-Xvnc (xorg-x11-Xvnc-5317)	Nessus	SuSE Local Security Checks	6/12/2008	1/14/2021	critical
67702	Oracle Linux 5 : xorg-x11-server (ELSA-2008-0504)	Nessus	Oracle Linux Local Security Checks	7/12/2013	10/22/2024	critical
60420	Scientific Linux Security Update : XFree86 on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	8/1/2012	1/14/2021	high
34738	HP-UX PHSS_38840 : HP-UX Running Xserver, Remote Execution of Arbitrary Code (HPSBUX02381 SSRT080083 rev.2)	Nessus	HP-UX Local Security Checks	11/11/2008	8/26/2025	high
34303	SuSE 10 Security Update : Xgl (ZYPP Patch Number 5528)	Nessus	SuSE Local Security Checks	9/28/2008	1/14/2021	critical
33152	RHEL 4 : xorg-x11 (RHSA-2008:0503)	Nessus	Red Hat Local Security Checks	6/12/2008	4/21/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

high

high

critical

critical