Description
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xorg-server | 1:1.0.2-8 | — |
| Debian 13 | xorg-server | 1:1.0.2-8 | — |
| Debian 12 | xorg-server | 1:1.0.2-8 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | xorg-x11 +17 | 6.8.2-1.EL.13.25.1 | RHSA-2006:0451 |
Advisories 1
- RHSA-2006:0451 Red Hat Security Advisory: xorg-x11 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- RHSA-2006:0451 vendor-advisory
- 19921 third-party-advisory
- 19943 third-party-advisory
- xorg-xrender-bo(26200) vdb-entry
- 19956 third-party-advisory
- MDKSA-2006:081 vendor-advisory
- ADV-2006-1617 vdb-entry
- 19951 third-party-advisory
- SUSE-SA:2006:023 vendor-advisory
- oval:org.mitre.oval:def:9929 vdb-entry signature
- 17795 vdb-entry
- 102339 vendor-advisory
- VU#633257 third-party-advisory
- 1016018 vdb-entry
- GLSA-200605-02 vendor-advisory
- 19983 third-party-advisory
- [3.8] 007: SECURITY FIX: May 2, 2006 vendor-advisory
- 2006-0024 vendor-advisory
- https://bugs.freedesktop.org/show_bug.cgi?id=6642
- 19900 third-party-advisory
- USN-280-1 vendor-advisory
- FLSA:190777 vendor-advisory
- 19915 third-party-advisory
- [xorg] 20060502 [CVE-2006-1525] X.Org security advisory: Buffer overflow in the Xrender extension mailing-list
- 19916 third-party-advisory