Secunia

Some vulnerabilities have been reported in the X.Org X11 X Font Server (XFS), which can be exploited by malicious, local users to gain escalated privileges.

1) An integer overflow exists within the handlers for the X protocol requests "QueryXBitmaps" and "QueryXExtents", which do not correctly check the "length" parameters before passing them to the "build_range()" function. This can be exploited to cause a heap-based buffer overflow by sending specially crafted "QueryXBitmaps" and "QueryXExtents" requests to a vulnerable service.

2) An error exists within the handler for the X protocol requests "QueryXBitmaps" and "QueryXExtents" when calling the "swap_char2b()" function, which can be exploited to swap an arbitrary number of bytes on the heap, resulting in a heap corruption.

Note: On certain systems (e.g. Sun Solaris), these vulnerabilities may be remotely exploitable through port 7100/TCP.

The vulnerabilities are reported in X.Org XFS 1.0.4 (X11R7.2 and X11R7.3) and prior.

Solution
Update to X.Org XFS 1.0.5.

Provided and/or discovered by
Sean Larsson, VeriSign iDefense Labs

Changelog
Further details available in Customer Area

Original Advisory
X.Org:
http://lists.freedesktop.org/archives/xorg-announce/2007-October/000416.html

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=602

Deep Links
Links available in Customer Area