Vulnerability Description
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| X.Org | X11R6 | 6.7.0 |
References
- http://lists.freedesktop.org/archives/xorg/2006-May/015136.htmlPatch
- http://secunia.com/advisories/19900PatchVendor Advisory
- http://secunia.com/advisories/19915PatchVendor Advisory
- http://secunia.com/advisories/19916PatchVendor Advisory
- http://secunia.com/advisories/19921PatchVendor Advisory
- http://secunia.com/advisories/19943PatchVendor Advisory
- http://secunia.com/advisories/19951PatchVendor Advisory
- http://secunia.com/advisories/19956PatchVendor Advisory
- http://secunia.com/advisories/19983
- http://securitytracker.com/id?1016018
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-102339-1
- http://www.gentoo.org/security/en/glsa/glsa-200605-02.xmlPatchVendor Advisory
- http://www.kb.cert.org/vuls/id/633257US Government Resource
- http://www.mandriva.com/security/advisories?name=MDKSA-2006:081
- http://www.novell.com/linux/security/advisories/2006_05_03.htmlPatchVendor Advisory
FAQ
What is CVE-2006-1526?
CVE-2006-1526 is a vulnerability with a CVSS score of 2.1 (LOW). Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRe...
How severe is CVE-2006-1526?
CVE-2006-1526 has been rated LOW with a CVSS base score of 2.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2006-1526?
Check the references section above for vendor advisories and patch information. Affected products include: X.Org X11R6.