| Description: | Description:
The remote host is missing updates announced in
advisory CLA-2004:821.
XFree86[1] is a freely redistributable open-source implementation of
the X Window System, which is a client/server interface between
display hardware and the desktop environment. Xlib is one of the main
libraries of XFree86 (libX11.so.6).
The following issues are being addressed in this update:
- Improper handling of font files (CVE-2004-0083[2], CVE-2004-0084[4]
and CVE-2004-0106[6])
Greg MacManus from iDEFENSE Labs discovered[3][5] two vulnerabilities
in the way the X server deals with font files. David Dawes from the
XFree86 team did some further audit and found more similar
problems[6].
All these vulnerabilities allow attackers who can authenticate
against the X server, or locally start it, to execute arbitrary code
as root.
- Multiple integer overflows in font libraries (CVE-2003-0730)[7]
blexim@hush.com of isen reported[8] multiple integer overflows in the
XFree86 font libraries that allow local or remote attackers to cause
a denial of service or execute arbitrary code via heap-based and
stack-based buffer overflow attacks.
Solution:
The apt tool can be used to perform RPM package upgrades
by running 'apt-get update' followed by 'apt-get upgrade'
http://www.securityspace.com/smysecure/catid.html?in=CLA-2004:821
http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=002004
Risk factor : Critical
CVSS Score:
10.0
|
