Web Browser 로는 FTP 접속이 불가능 합니다.

문서번호 : 1201544447
업데이트 : 2008.01.29


상세내용

CVE-2007-4568:
Integer overflow in the build_range function in X.Org X Font Server (xfs) before 1.0.5
allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and
(2) QueryXExtents protocol requests with crafted size values, which triggers a
heap-based buffer overflow.

CVE-2007-4990:
The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent
attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol
requests with crafted size values that specify an arbitrary number of bytes to be swapped
on the heap, which triggers heap corruption.

CVE-2007-5958:
X.Org Xserver before 1.4.1 allows local users to determine the existence of arbitrary
files via a filename argument in the -sp option to the X program, which produces
different error messages depending on whether the filename exists.

CVE-2007-6427:
The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers
to execute arbitrary code via requests related to byte swapping and heap corruption
within multiple functions, a different vulnerability than CVE-2007-4990.

CVE-2007-6428:
The ProcGetReservedColormapEntries function in the TOG-CUP extension in X.Org Xserver
before 1.4.1 allows context-dependent attackers to read the contents of arbitrary
memory locations via a request containing a 32-bit value that is improperly used as an
array index.

CVE-2007-6429:
Multiple integer overflows in X.Org Xserver before 1.4.1 allow context-dependent
attackers to execute arbitrary code via (1) a GetVisualInfo request containing a
32-bit value that is improperly used to calculate an amount of memory for allocation
by the EVI extension, or (2) a request containing values related to pixmap size that
are improperly used in management of shared memory by the MIT-SHM extension.

CVE-2008-0006:
Buffer overflow in (1) X.Org Xserver before 1.4.1 and (2) the Sun Solaris libfont and
libXfont libraries allows context-dependent attackers to execute arbitrary code via a
PCF font with a large difference between the last col and first col values in the
PCF_BDF_ENCODINGS table.


Autoupdates 지원 : 지원


update 패키지

  RPMS :

    . XFree86-libs-4.1.0-86.i686.rpm
    . XFree86-devel-4.1.0-86.i686.rpm
    . XFree86-4.1.0-86.i686.rpm
    . XFree86-xfs-4.1.0-86.i686.rpm

  SRPMS :

    . XFree86-4.1.0-86.src.rpm


참고 :
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4568
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4990
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5958
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6427
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6428
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6429
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0006