Explain CVE-2006-1526
Buffer overflow in the X render (Xrender) extension in X.org X server 6.8.0 up to allows attackers to cause a denial of service (crash), as demonstrated by the (1) XRenderCompositeTriStrip and (2) XRenderCompositeTriFan requests in the rendertest from XCB xcb/xcb-demo, which leads to an incorrect memory allocation due to a typo in an expression that uses a "&" instead of a "*" operator. NOTE: the subject line of the original announcement used an incorrect CVE number for this issue.
Affected Products: n/a
References: [{'name': 'RHSA-2006:0451', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://www.redhat.com/support/errata/RHSA-2006-0451.html'}, {'name': '19921', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19921'}, {'name': '19943', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19943'}, {'name': 'xorg-xrender-bo(26200)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/26200'}, {'name': '19956', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19956'}, {'name': 'MDKSA-2006:081', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDKSA-2006:081'}, {'name': 'ADV-2006-1617', 'tags': ['vdb-entry', 'x_refsource_VUPEN'], 'url': 'http://www.vupen.com/english/advisories/2006/1617'}, {'name': '19951', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19951'}, {'name': 'SUSE-SA:2006:023', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://www.novell.com/linux/security/advisories/2006_05_03.html'}, {'name': 'oval:org.mitre.oval:def:9929', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9929'}, {'name': '17795', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/17795'}, {'name': '102339', 'tags': ['vendor-advisory', 'x_refsource_SUNALERT'], 'url': 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-102339-1'}, {'name': 'VU#633257', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'http://www.kb.cert.org/vuls/id/633257'}, {'name': '1016018', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1016018'}, {'name': 'GLSA-200605-02', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-200605-02.xml'}, {'name': '19983', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19983'}, {'name': '[3.8] 007: SECURITY FIX: May 2, 2006', 'tags': ['vendor-advisory', 'x_refsource_OPENBSD'], 'url': 'http://www.openbsd.org/errata38.html#xorg'}, {'name': '2006-0024', 'tags': ['vendor-advisory', 'x_refsource_TRUSTIX'], 'url': 'http://www.trustix.org/errata/2006/0024'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.freedesktop.org/show_bug.cgi?id=6642'}, {'name': '19900', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19900'}, {'name': 'USN-280-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'https://usn.ubuntu.com/280-1/'}, {'name': 'FLSA:190777', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://www.securityfocus.com/archive/1/436327/100/0/threaded'}, {'name': '19915', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19915'}, {'name': '[xorg] 20060502 [CVE-2006-1525] X.Org security advisory: Buffer overflow in the Xrender extension', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://lists.freedesktop.org/archives/xorg/2006-May/015136.html'}, {'name': '19916', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/19916'}]
CVE State: PUBLISHED