Multiple integer overflows in X.org libXext 1.3.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XcupGetReservedColormapEntries, (2) XcupStoreColors, (3) XdbeGetVisualInfo, (4) XeviGetVisualInfo, (5) XShapeGetRectangles, and (6) XSyncListSystemCounters functions.

Multiple integer overflows in X.org libXext 1.3.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XcupGetReservedColormapEntries, (2) XcupStoreColors, (3) XdbeGetVisualInfo, (4) XeviGetVisualInfo, (5) XShapeGetRectangles, and (6) XSyncListSystemCounters functions.

libXext-devel-1.3.3-3.19 on GA media

libX11: Multiple integer overflows leading to heap-based buffer-overflows libXext: Multiple integer overflows leading to heap-based buffer-overflows libXfixes: Integer overflow leading to heap-based buffer overflow libXi: Multiple integer overflows leading to heap-based buffer-overflows libXinerama: Integer overflow leading to heap-based buffer overflow libXrandr: Multiple integer overflows leading to heap-based bufer overflows libXrender: Multiple integer overflows leading to heap-based bufer overflows libXRes: Multiple integer overflows leading to heap-based bufer overflows libXv: Multiple integer overflows leading to heap-based bufer overflows libXvMC: Multiple integer overflows leading to heap-based buffer overflows libXxf86dga: Multiple integer overflows leading to heap-based buffer overflows libdmx: Multiple integer overflows leading to heap-based bufer overflows libXi: Sign extension issues resulting in heap-based buffer overflow libX11: Multiple Array Index error leading to heap-based OOB write libXi: Multiple Array Index error leading to heap-based OOB write libXvMC: Array Index error leading to heap-based OOB write libXxf86dga: Array Index error leading to heap-based OOB write libXxf86vm: Multiple Array Index error leading to heap-based OOB write libXt: Array Index error leading to heap-based OOB write libXcursor: Integer overflow leading to heap-based buffer overflow libX11: unbounded recursion leading to stack-overflow libXt: Memory corruption due to unchecked us…