CVE-2014-8092

Múltiples desbordamientos de enteros en X.Org X Window System (también conocido como X11 o X) X11R1 y X.Org Server (también conocido como xserver y xorg-server) anterior a 1.16.3 permiten a usuarios remotos autenticados causar una denegación de servicio (caída) o posiblemente ejecutar código arbitrario a través de una solicitud manipulada en la función (1) ProcPutImage, (2) GetHosts, (3) RegionSizeof, o (4) REQUEST_FIXED_SIZE, lo que provoca una lectura o escritura fuera de rango.

Multiple integer overflow flaws were found in the way the X.Org server calculated memory requirements for certain X11 core protocol requests. A malicious, authenticated client could use either of these flaws to crash the X.Org server or, potentially, execute arbitrary code with root privileges.

Ilja van Sprundel of IOActive discovered several security issues in the X.org X server, which may lead to privilege escalation or denial of service. Olivier Fourdan from Red Hat has discovered a protocol handling issue in the way the X server code base handles the XkbSetGeometry request, where the server trusts the client to send valid string lengths. A malicious client with string lengths exceeding the request length can cause the server to copy adjacent memory data into the XKB structs. This data is then available to the client via the XkbGetGeometry request. This can lead to information disclosure issues, as well as possibly a denial of service if a similar request can cause the server to crash.