Description
Buffer overflow in the compNewPixmap function in compalloc.c in the Composite extension for the X.org X11 server before 1.4 allows local users to execute arbitrary code by copying data from a large pixel depth pixmap into a smaller pixel depth pixmap.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xorg-server | 2:1.4-1 | — |
| Debian 13 | xorg-server | 2:1.4-1 | — |
| Debian 12 | xorg-server | 2:1.4-1 | — |
| Debian 5.0 | xorg-server | 2:1.3.0.0.dfsg-12lenny1 | DTSA-73-1 |
| Debian 4.0 | xorg-server | 2:1.1.1-21etch1 | DSA-1372-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | xorg-x11 +17 | 6.8.2-1.EL.31 | RHSA-2007:0898 |
Advisories 3
- RHSA-2007:0898 Red Hat Security Advisory: xorg-x11 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-73-1 xorg-server - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1372-1 xorg-server - privilege escalation Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SA:2007:054 vendor-advisory
- MDKSA-2007:178 vendor-advisory
- [xorg-announce] 20070906 xorg-server 1.4 mailing-list
- 37726 vdb-entry
- 26823 third-party-advisory
- https://issues.rpath.com/browse/RPL-1728
- GLSA-200710-16 vendor-advisory
- 26859 third-party-advisory
- 27147 third-party-advisory
- RHSA-2007:0898 vendor-advisory
- MDVSA-2008:022 vendor-advisory
- 25606 vdb-entry
- USN-514-1 vendor-advisory
- 26743 third-party-advisory
- 27228 third-party-advisory
- 30161 third-party-advisory
- xorg-composite-bo(36535) vdb-entry
- GLSA-200805-07 vendor-advisory
- 1018665 vdb-entry
- http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0187
- 26897 third-party-advisory
- 26755 third-party-advisory
- http://bugs.freedesktop.org/show_bug.cgi?id=7447
- 26763 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2007-394.htm
- oval:org.mitre.oval:def:10430 vdb-entry signature
- 27179 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=191964
- DSA-1372 vendor-advisory
- ADV-2007-3098 vdb-entry