Integer overflow in the AllocateGlyph function in the Render extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to execute arbitrary code via unspecified request fields that are used to calculate a heap buffer size, which triggers a heap-based buffer overflow.

Multiple integer overflows in the Render extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via a (1) SProcRenderCreateLinearGradient, (2) SProcRenderCreateRadialGradient, or (3) SProcRenderCreateConicalGradient request with an invalid field specifying the number of bytes to swap in the request data, which triggers heap memory corruption.

The (1) SProcRecordCreateContext and (2) SProcRecordRegisterClients functions in the Record extension and the (3) SProcSecurityGenerateAuthorization function in the Security extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via requests with crafted length values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.

Integer overflow in the fbShmPutImage function in the MIT-SHM extension in the X server 1.4 in X.Org X11R7.3 allows context-dependent attackers to read arbitrary process memory via crafted values for a Pixmap width and height.

It was found that xrdb, the X server resource database utility, did not properly sanitize system host names, containing shell escape characters, during launch of user graphical session (when the display manager retrieved the system host name from resource database via xrdb). When the display manager was configured to listen for X Display Manager Control Protocol (XDMCP) messages, a remote attacker could use this flaw to remotely execute arbitrary code with the privileges, of the user running the display manager (usually privileged system user, root). On systems, where the XDMCP messages were disabled and the system was configured to retrieve its host name from remote DHCP server, a rogue DHCP server could use this flaw to possibly execute arbitrary code with the privileges of the user running the display manager (usually root) via a specially-crafted host name assigned to the victim host in question.

Note: ===== The display managers, shipped with Red Hat Enterprise Linux 4, 5, and 6 do not listen for remote XDMCP messages in the default configuration, which mitigates this security flaw to be exploitable only by rogue remote DHCP servers.

The display managers, shipped with Fedora release of 13 and 14 do not listen for remote XDMCP messages in the default configuration, which mitigates this security flaw to be exploitable only by rogue remote DHCP servers.