Freely subscribe to our NEWSLETTER

This bulletin was written by Vigil@nce : http://vigilance.fr/offer

SYNTHESIS OF THE VULNERABILITY

An attacker can generate an integer overflow when X.Org displays a
trapezoid, in order to trigger a denial of service, and possibly
to execute code.

Impacted products: Debian, openSUSE, RHEL, Unix (platform)

Severity: 2/4

Creation date: 20/12/2013

DESCRIPTION OF THE VULNERABILITY

The X.Org graphic library can display trapezoids.

However, the exaTrapezoids() function of the exa/exa_render.c file
does not check if a size is too large, then a multiplication
overflows, and an allocated memory area is too short.

An attacker can therefore generate an integer overflow when X.Org
displays a trapezoid, in order to trigger a denial of service, and
possibly to execute code.

ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN

http://vigilance.fr/vulnerability/X-Org-integer-overflow-via-a-trapezoid-13971