Description
The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuthorization function in the Security extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via requests with crafted length values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | xorg-server | 2:1.4.1~git20080517-2 | — |
| Debian 13 | xorg-server | 2:1.4.1~git20080517-2 | — |
| Debian 12 | xorg-server | 2:1.4.1~git20080517-2 | — |
| Debian 5.0 | xorg-server | 2:1.4.1~git20080517-2~lenny1 | DTSA-141-1 |
| Debian 4.0 | xorg-server | 2:1.1.1-21etch5 | DSA-1595-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | xorg-x11-server +6 | 1.1.1-48.41.el5_2.1 | RHSA-2008:0504 |
| RHEL 4 | xorg-x11 +17 | 6.8.2-1.EL.33.0.4 | RHSA-2008:0503 |
| RHEL 3 | XFree86 +29 | 4.3.0-128.EL | RHSA-2008:0502 |
| RHEL 2 | XFree86 +19 | 4.1.0-88.EL | RHSA-2008:0512 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xorg-x11-server | 1.20.13-1.2 | openSUSE-SU-2024:11525-1 |
Advisories 7
- RHSA-2008:0504 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0512 Red Hat Security Advisory: XFree86 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0503 Red Hat Security Advisory: xorg-x11 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2008:0502 Red Hat Security Advisory: XFree86 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1595-1 xorg-server - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-141-1 xorg-server - multiple vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11525-1 xorg-x11-server-1.20.13-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://issues.rpath.com/browse/RPL-2607
- 30629 third-party-advisory
- 20080611 Multiple Vendor X Server Record and Security Extensions Multiple Memory Corruption Vulnerabilities third-party-advisory
- oval:org.mitre.oval:def:10109 vdb-entry signature
- 238686 vendor-advisory
- 33937 third-party-advisory
- 30664 third-party-advisory
- MDVSA-2008:115 vendor-advisory
- 20080621 rPSA-2008-0201-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs mailing-list
- 31025 third-party-advisory
- RHSA-2008:0502 vendor-advisory
- SSRT080083 vendor-advisory
- http://support.apple.com/kb/HT3438
- APPLE-SA-2009-02-12 vendor-advisory
- ADV-2008-1833 vdb-entry
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0201
- GLSA-200806-07 vendor-advisory
- 30715 third-party-advisory
- 30666 third-party-advisory
- 30627 third-party-advisory
- 30637 third-party-advisory
- MDVSA-2008:116 vendor-advisory
- ADV-2008-1803 vdb-entry
- http://support.avaya.com/elmodocs2/security/ASA-2008-249.htm
- SUSE-SA:2008:027 vendor-advisory
- 30772 third-party-advisory
- 1020247 vdb-entry
- RHSA-2008:0503 vendor-advisory
- 30628 third-party-advisory
- 30659 third-party-advisory
- 31109 third-party-advisory
- ADV-2008-1983 vdb-entry
- 30671 third-party-advisory
- 30809 third-party-advisory
- ADV-2008-3000 vdb-entry
- [xorg] 20080611 X.Org security advisory june 2008 - Multiple vulnerabilities in X server extensions mailing-list
- RHSA-2008:0504 vendor-advisory
- 32545 third-party-advisory
- 30843 third-party-advisory
- DSA-1595 vendor-advisory
- USN-616-1 vendor-advisory
- 32099 third-party-advisory
- https://issues.rpath.com/browse/RPL-2619
- SUSE-SR:2008:019 vendor-advisory
- RHSA-2008:0512 vendor-advisory
- 20080620 rPSA-2008-0200-1 xorg-server mailing-list
- 30630 third-party-advisory
- GLSA-200807-07 vendor-advisory