|
|
Family: Mandrake Local Security Checks --> Category: infos
MDKSA-2004:124: xorg-x11 Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the xorg-x11 package
Detailed Explanation for this Vulnerability Test
The remote host is missing the patch for the advisory MDKSA-2004:124 (xorg-x11).
Chris Evans found several stack and integer overflows in the libXpm code of
X.Org/XFree86:
Stack overflows (CVE-2004-0687):
Careless use of strcat() in both the XPMv1 and XPMv2/3 xpmParseColors code
leads to a stack based overflow (parse.c).
Stack overflow reading pixel values in ParseAndPutPixels (create.c) as well as
ParsePixels (parse.c).
Integer Overflows (CVE-2004-0688):
Integer overflow allocating colorTable in xpmParseColors (parse.c) - probably a
crashable but not exploitable offence.
Additionally, the xorg-x11 packages have been patched with a backport from cvs
to resolve a failure running the lsb-test-vsw4 test suite, which will soon be
required for LSB2.0 compliance.
The updated packages have patches from Chris Evans and Matthieu Herrb to
address these vulnerabilities.
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2004:124
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
