<em style='font-weight:bold;'>(Description Provided by <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-6102" target="_blank">CVE</a>)</em> : Integer overflow in the ProcDbeGetVisualInfo function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of unspecified data structures.

Upgrade to version 7.2 RC3 or higher, as it has been reported to fix this vulnerability. It is also possible to temporarily work around the flaw by implementing the following workaround: Access to the vulnerable code can be prevented when the Render extension is not built into the X binary. This can be accomplished by removing the entry for the Render extension from your X server's configuration file, often stored in /etc/X11 and named xorg.conf or XF86Config-4. To do this, remove the following line from the 'Module' section:

Load "render"

This will prevent the Render extension from loading, which may affect the appearance or operation of some applications.

Unknown or Incomplete

• Security Tracker: 1017495
• CVE ID: 2006-6102 (see also: NVD)
• Bugtraq ID: 21968
• Secunia Advisory ID: 23684 23789 24210 24247 24401 25802
• SCIP VulDB ID: 2816
• ISS X-Force ID: 31376
• VUPEN Advisory: ADV-2007-0108 ADV-2007-0109 ADV-2007-0589 ADV-2007-0669 ADV-2007-2233
• Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-01/0267.html
• Other Advisory URL: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=463
  http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00004.html
  http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.393555
  http://support.avaya.com/elmodocs2/security/ASA-2007-066.htm
• Vendor Specific Advisory URL: http://support.avaya.com/elmodocs2/security/ASA-2007-074.htm
• Vendor Specific Solution URL: https://www4.itrc.hp.com/service/cki/docDisplay.do?docId=c01075678
• RedHat RHSA: RHSA-2007:0002 RHSA-2007:0003

• Sean Larsson - iDefense Labs