Family: Mandrake Local Security Checks --> Category: infos
MDKSA-2004:099: XFree86 Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the XFree86 package
Detailed Explanation for this Vulnerability Test
The remote host is missing the patch for the advisory MDKSA-2004:099 (XFree86).
Chris Evans found several stack and integer overflows in the libXpm code of
Stack overflows (CVE-2004-0687):
Careless use of strcat() in both the XPMv1 and XPMv2/3 xpmParseColors code leads
to a stack based overflow (parse.c).
Stack overflow reading pixel values in ParseAndPutPixels (create.c) as well as
Integer Overflows (CVE-2004-0688):
Integer overflow allocating colorTable in xpmParseColors (parse.c) - probably a
crashable but not exploitable offence.
The updated packages have patches from Chris Evans and Matthieu Herrb to address
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2004:099
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.