Description
The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | xorg-x11-server +7 | 1.1.1-48.76.el5_5.1 | RHSA-2010:0382 |
Advisories 1
- RHSA-2010:0382 Red Hat Security Advisory: xorg-x11-server security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- RHSA-2010:0382 vendor-advisory
- 1023929 vdb-entry
- 39650 third-party-advisory
- 39834 third-party-advisory
- oval:org.mitre.oval:def:10112 vdb-entry signature
- http://cgit.freedesktop.org/xorg/xserver/commit/?id=d2f813f7db
- https://bugzilla.redhat.com/show_bug.cgi?id=495733
- https://bugzilla.redhat.com/show_bug.cgi?id=582601
- SUSE-SR:2010:014 vendor-advisory
- ADV-2010-1185 vdb-entry
- USN-939-1 vendor-advisory