Libxrender
Monthly
Heap-based buffer overflow in X.Org libXrender before 0.9.13 allows a malicious or compromised X server to inject and execute arbitrary code in attached X11 clients via a crafted response to the RenderQueryPictFormats request. This is a reverse-direction attack where the victim must actively connect a vulnerable X11 client (linked against libXrender < 0.9.13) to an attacker-controlled or hijacked X server - typical exposure is via SSH X11 forwarding to an untrusted host or a remote DISPLAY connection; local trusted X servers are not affected. No public exploit code has been identified at time of analysis, and exploitation is non-trivial (AC:H) with no attacker authentication required (PR:N), but an upstream fix is available and the CVE description identifies 0.9.13 as the fixed version boundary.
The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple integer overflows in X.org libXrender 0.9.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRenderQueryFilters,. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Heap-based buffer overflow in X.Org libXrender before 0.9.13 allows a malicious or compromised X server to inject and execute arbitrary code in attached X11 clients via a crafted response to the RenderQueryPictFormats request. This is a reverse-direction attack where the victim must actively connect a vulnerable X11 client (linked against libXrender < 0.9.13) to an attacker-controlled or hijacked X server - typical exposure is via SSH X11 forwarding to an untrusted host or a remote DISPLAY connection; local trusted X servers are not affected. No public exploit code has been identified at time of analysis, and exploitation is non-trivial (AC:H) with no attacker authentication required (PR:N), but an upstream fix is available and the CVE description identifies 0.9.13 as the fixed version boundary.
The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X servers to trigger out-of-bounds write operations via vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple integer overflows in X.org libXrender 0.9.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRenderQueryFilters,. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.