Description
The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via requests related to byte swapping and heap corruption within multiple functions, a different vulnerability than CVE-2007-4990.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xorg-server | 2:1.4.1~git20080105-2 | — |
| Debian 13 | xorg-server | 2:1.4.1~git20080105-2 | — |
| Debian 12 | xorg-server | 2:1.4.1~git20080105-2 | — |
| Debian 5.0 | xorg-server | 2:1.3.0.0.dfsg-12lenny2 | DTSA-110-1 |
| Debian 4.0 | xorg-server | 2:1.1.1-21etch3 | DSA-1466-2 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | xfree86 | 4.3.0.dfsg.1-14sarge7 | DSA-1466-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | xorg-x11-server +6 | 1.1.1-48.26.el5_1.5 | RHSA-2008:0031 |
| RHEL 4 | xorg-x11 +17 | 6.8.2-1.EL.33.0.2 | RHSA-2008:0030 |
| RHEL 3 | XFree86 +29 | 4.3.0-126.EL | RHSA-2008:0029 |
| RHEL 2 | XFree86 +19 | 4.1.0-86.EL | RHSA-2008:0029 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xorg-x11-server | 1.20.13-1.2 | openSUSE-SU-2024:11525-1 |
Advisories 6
- RHSA-2008:0031 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0029 Red Hat Security Advisory: XFree86 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0030 Red Hat Security Advisory: xorg-x11 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1466-2 libxfont xfree86 xorg-server - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-110-1 xorg-server - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11525-1 xorg-x11-server-1.20.13-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- oval:org.mitre.oval:def:10372 vdb-entry signature
- 28542 third-party-advisory
- 29139 third-party-advisory
- 27336 vdb-entry
- ADV-2008-0184 vdb-entry
- 29622 third-party-advisory
- FEDORA-2008-0831 vendor-advisory
- SUSE-SA:2008:003 vendor-advisory
- SUSE-SR:2008:008 vendor-advisory
- 28532 third-party-advisory
- 29707 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-078.htm
- 28843 third-party-advisory
- DSA-1466 vendor-advisory
- 27351 vdb-entry
- 28540 third-party-advisory
- SSRT080083 vendor-advisory
- 20080130 rPSA-2008-0032-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs mailing-list
- ADV-2008-0703 vdb-entry
- MDVSA-2008:021 vendor-advisory
- ADV-2008-0924 vdb-entry
- 28718 third-party-advisory
- 200153 vendor-advisory
- RHSA-2008:0029 vendor-advisory
- 28584 third-party-advisory
- [4.1] 20080208 012: SECURITY FIX: February 8, 2008 vendor-advisory
- 28941 third-party-advisory
- 28592 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2008-039.htm
- 29420 third-party-advisory
- MDVSA-2008:022 vendor-advisory
- APPLE-SA-2008-03-18 vendor-advisory
- 30161 third-party-advisory
- GLSA-200805-07 vendor-advisory
- RHSA-2008:0030 vendor-advisory
- 28543 third-party-advisory
- 28273 third-party-advisory
- RHSA-2008:0031 vendor-advisory
- 28550 third-party-advisory
- ADV-2008-0497 vdb-entry
- http://bugs.gentoo.org/show_bug.cgi?id=204362
- MDVSA-2008:023 vendor-advisory
- 28885 third-party-advisory
- 103200 vendor-advisory
- MDVSA-2008:025 vendor-advisory
- USN-571-1 vendor-advisory
- GLSA-200804-05 vendor-advisory
- 28535 third-party-advisory
- ADV-2008-3000 vdb-entry
- http://docs.info.apple.com/article.html?artnum=307562
- 20080117 Multiple Vendor X Server XInput Extension Multiple Memory Corruption Vulnerabilities third-party-advisory
- [xorg] 20080117 X.Org security advisory: multiple vulnerabilities in the X server mailing-list
- http://www14.software.ibm.com/webapp/set2/subscriptions/ijhifoeblist?mode=7&heading=AIX61&path=/200802/SECURITY/20080227/datafile112539&label=AIX%20X%20server%20multiple%20vulnerabilities
- 32545 third-party-advisory
- xorg-xinput-code-execution(39759) vdb-entry
- 28838 third-party-advisory
- 1019232 vdb-entry
- https://issues.rpath.com/browse/RPL-2010
- [4.2] 20080208 006: SECURITY FIX: February 8, 2008 vendor-advisory
- 28539 third-party-advisory