This is an OpenPGP/MIME signed message (RFC 2440 and 3156)

--------------enigF74A71D7AF3BA12781236E28

Content-Type: text/plain; charset=ISO-8859-1

Content-Transfer-Encoding: 7bit



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory                           GLSA 200509-07

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                                            http://security.gentoo.org/

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



  Severity: High

     Title: X.Org: Heap overflow in pixmap allocation

      Date: September 12, 2005

      Bugs: #105688

        ID: 200509-07



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Synopsis

========



An integer overflow in pixmap memory allocation potentially allows any

X.Org user to execute arbitrary code with elevated privileges.



Background

==========



X.Org is X.Org Foundation's Public Implementation of the X Window

System.



Affected packages

=================



    -------------------------------------------------------------------

     Package            /  Vulnerable  /                    Unaffected

    -------------------------------------------------------------------

  1  x11-base/xorg-x11     < 6.8.2-r3                      >= 6.8.2-r3



Description

===========



X.Org is missing an integer overflow check during pixmap memory

allocation.



Impact

======



An X.Org user could exploit this issue to make the X server execute

arbitrary code with elevated privileges.



Workaround

==========



There is no known workaround at this time.



Resolution

==========



All X.org users should upgrade to the latest version:



    # emerge --sync

    # emerge --ask --oneshot --verbose
 ">=x11-base/xorg-x11-6.8.2-r3"



References

==========



  [ 1 ] CAN-2005-2495

        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2495



Availability

============



This GLSA and any updates to it are available for viewing at

the Gentoo Security Website:



  http://security.gentoo.org/glsa/glsa-200509-07.xml



Concerns?

=========



Security is a primary focus of Gentoo Linux and ensuring the

confidentiality and security of our users machines is of utmost

importance to us. Any security concerns should be addressed to

security@gentoo.org or alternatively, you may file a bug at

http://bugs.gentoo.org.



License

=======



Copyright 2005 Gentoo Foundation, Inc; referenced text

belongs to its owner(s).



The contents of this document are licensed under the

Creative Commons - Attribution / Share Alike license.



http://creativecommons.org/licenses/by-sa/2.0





--------------enigF74A71D7AF3BA12781236E28

Content-Type: application/pgp-signature; name="signature.asc"

Content-Description: OpenPGP digital signature

Content-Disposition: attachment; filename="signature.asc"



-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.1 (GNU/Linux)



iD8DBQFDJaGQvcL1obalX08RAu1VAJ9VDO/H6GKtXf2PY6j6cETTCTcTwgCgjdk2

nfVDxN5hwZIwBA5oPF7mwmI=

=IkJN

-----END PGP SIGNATURE-----



--------------enigF74A71D7AF3BA12781236E28--

-- 

gentoo-announce@gentoo.org mailing list