Multiple buffer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the (1) XAllocColorCells, (2) _XkbReadGetDeviceInfoReply, (3) _XkbReadGeomShapes, (4) _XkbReadGetGeometryReply, (5) _XkbReadKeySyms, (6) _XkbReadKeyActions, (7) _XkbReadKeyBehaviors, (8) _XkbReadModifierMap, (9) _XkbReadExplicitComponents, (10) _XkbReadVirtualModMap, (11) _XkbReadGetNamesReply, (12) _XkbReadGetMapReply, (13) _XimXGetReadData, (14) XListFonts, (15) XListExtensions, and (16) XGetFontPath functions.

Multiple buffer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the (1) XAllocColorCells, (2) _XkbReadGetDeviceInfoReply, (3) _XkbReadGeomShapes, (4) _XkbReadGetGeometryReply, (5) _XkbReadKeySyms, (6) _XkbReadKeyActions, (7) _XkbReadKeyBehaviors, (8) _XkbReadModifierMap, (9) _XkbReadExplicitComponents, (10) _XkbReadVirtualModMap, (11) _XkbReadGetNamesReply, (12) _XkbReadGetMapReply, (13) _XimXGetReadData, (14) XListFonts, (15) XListExtensions, and (16) XGetFontPath functions.

libX11-6-1.6.4-2.1 on GA media

libX11: Multiple integer overflows leading to heap-based buffer-overflows libXext: Multiple integer overflows leading to heap-based buffer-overflows libXfixes: Integer overflow leading to heap-based buffer overflow libXi: Multiple integer overflows leading to heap-based buffer-overflows libXinerama: Integer overflow leading to heap-based buffer overflow libXrandr: Multiple integer overflows leading to heap-based bufer overflows libXrender: Multiple integer overflows leading to heap-based bufer overflows libXRes: Multiple integer overflows leading to heap-based bufer overflows libXv: Multiple integer overflows leading to heap-based bufer overflows libXvMC: Multiple integer overflows leading to heap-based buffer overflows libXxf86dga: Multiple integer overflows leading to heap-based buffer overflows libdmx: Multiple integer overflows leading to heap-based bufer overflows libXi: Sign extension issues resulting in heap-based buffer overflow libX11: Multiple Array Index error leading to heap-based OOB write libXi: Multiple Array Index error leading to heap-based OOB write libXvMC: Array Index error leading to heap-based OOB write libXxf86dga: Array Index error leading to heap-based OOB write libXxf86vm: Multiple Array Index error leading to heap-based OOB write libXt: Array Index error leading to heap-based OOB write libXcursor: Integer overflow leading to heap-based buffer overflow libX11: unbounded recursion leading to stack-overflow libXt: Memory corruption due to unchecked us…

Security update for xorg-x11-libX11