CVE-2006-1526
published 2006-05-02CVE-2006-1526: Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the…
PriorityP49low2.1CVSS 2.0
AVLACLAuNCNINAP
EPSS
0.51%
40.8th percentile
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | xorg-server | < xorg-server 1:1.0.2-8 (bookworm) | xorg-server 1:1.0.2-8 (bookworm) |
| x.org | x11r6 | — | — |
| x.org | x11r6 | — | — |
| x.org | x11r6 | — | — |
| x.org | x11r6 | — | — |
| x.org | xorg-server | >= 0 < 1:1.0.2-8 | 1:1.0.2-8 |
| x.org | xorg-server | >= 0 < 1:1.0.2-8 | 1:1.0.2-8 |
| x.org | xorg-server | >= 0 < 1:1.0.2-8 | 1:1.0.2-8 |
| x.org | xorg-server | >= 0 < 1:1.0.2-8 | 1:1.0.2-8 |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:N/A:P
osv2.1LOW
vendor_debian2.1LOW
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h3hm-p5jw-xp4h: Buffer overflow in the X render (Xrender) extension in X
ghsa_unreviewed·2022-05-01
CVE-2006-1526 [LOW] GHSA-h3hm-p5jw-xp4h: Buffer overflow in the X render (Xrender) extension in X
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
OSV
CVE-2006-1526: Buffer overflow in the X render (Xrender) extension in X
osv·2006-05-02·CVSS 2.1
CVE-2006-1526 [LOW] CVE-2006-1526: Buffer overflow in the X render (Xrender) extension in X
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
Ubuntu
X.org server vulnerability
vendor_ubuntu·2006-05-04
CVE-2006-1526 X.org server vulnerability
Title: X.org server vulnerability
Summary: X.org server vulnerability
The Render extension of the X.org server incorrectly calculated the
size of a memory buffer, which led to a buffer overflow. A local
attacker could exploit this to crash the X server or even execute
arbitrary code with root privileges.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
security flaw
vendor_redhat·2006-05-02·CVSS 2.1
CVE-2006-1526 [LOW] security flaw
security flaw
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
Debian
CVE-2006-1526: xorg-server - Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up t...
vendor_debian·2006·CVSS 2.1
CVE-2006-1526 [LOW] CVE-2006-1526: xorg-server - Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up t...
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
Scope: local
bookworm: resolved (fixed in 1:1.0.2-8)
bullseye: resolved (fixed in 1:1.0.2-8)
forky: resolved (fixed in 1:1.0.2-8)
sid: resolved (fixed in 1:1.0.2-8)
trixie: resolved (fixed in 1:1.0.2-8)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2006-1526 security flaw
bugzilla·2018-08-16·CVSS 2.1
CVE-2006-1526 [LOW] CVE-2006-1526 security flaw
CVE-2006-1526 security flaw
Flaw bug created to hold information about an old flaw we knew something about. For more details see the MITRE CVE description.
Discussion:
MITRE description:
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
Bugzilla
CVE-2006-1526 X.Org buffer overflow
bugzilla·2006-04-24·CVSS 2.1
CVE-2006-1526 [LOW] CVE-2006-1526 X.Org buffer overflow
CVE-2006-1526 X.Org buffer overflow
X.Org buffer overflow
Bart Massey, a X.Org user reported that "When running rendertest from
XCB xcb/xcb-demo, the Xorg X server crashes partway through. 100%
reproducible on a wide variety of graphics architectures".
The upstream bug for this issue can be found here:
https://bugs.freedesktop.org/show_bug.cgi?id=6642
The problem, analyzed by Eric Anholt is a typo in render/mitri.c,
which was incorrectly calculating the size of a buffer.
Discussion:
now public, removing embargo
http://lists.freedesktop.org/archives/xorg/2006-May/015136.html
---
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to
http://lists.freedesktop.org/archives/xorg/2006-May/015136.htmlhttp://secunia.com/advisories/19900http://secunia.com/advisories/19915http://secunia.com/advisories/19916http://secunia.com/advisories/19921http://secunia.com/advisories/19943http://secunia.com/advisories/19951http://secunia.com/advisories/19956http://secunia.com/advisories/19983http://securitytracker.com/id?1016018http://sunsolve.sun.com/search/document.do?assetkey=1-26-102339-1http://www.gentoo.org/security/en/glsa/glsa-200605-02.xmlhttp://www.kb.cert.org/vuls/id/633257http://www.mandriva.com/security/advisories?name=MDKSA-2006:081http://www.novell.com/linux/security/advisories/2006_05_03.htmlhttp://www.openbsd.org/errata38.html#xorghttp://www.redhat.com/support/errata/RHSA-2006-0451.htmlhttp://www.securityfocus.com/archive/1/436327/100/0/threadedhttp://www.securityfocus.com/bid/17795http://www.trustix.org/errata/2006/0024http://www.vupen.com/english/advisories/2006/1617https://bugs.freedesktop.org/show_bug.cgi?id=6642https://exchange.xforce.ibmcloud.com/vulnerabilities/26200https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9929https://usn.ubuntu.com/280-1/http://lists.freedesktop.org/archives/xorg/2006-May/015136.htmlhttp://secunia.com/advisories/19900http://secunia.com/advisories/19915http://secunia.com/advisories/19916http://secunia.com/advisories/19921http://secunia.com/advisories/19943http://secunia.com/advisories/19951http://secunia.com/advisories/19956http://secunia.com/advisories/19983http://securitytracker.com/id?1016018http://sunsolve.sun.com/search/document.do?assetkey=1-26-102339-1http://www.gentoo.org/security/en/glsa/glsa-200605-02.xmlhttp://www.kb.cert.org/vuls/id/633257http://www.mandriva.com/security/advisories?name=MDKSA-2006:081http://www.novell.com/linux/security/advisories/2006_05_03.htmlhttp://www.openbsd.org/errata38.html#xorghttp://www.redhat.com/support/errata/RHSA-2006-0451.htmlhttp://www.securityfocus.com/archive/1/436327/100/0/threadedhttp://www.securityfocus.com/bid/17795http://www.trustix.org/errata/2006/0024http://www.vupen.com/english/advisories/2006/1617https://bugs.freedesktop.org/show_bug.cgi?id=6642https://exchange.xforce.ibmcloud.com/vulnerabilities/26200https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9929https://usn.ubuntu.com/280-1/
2006-05-02
Published