National Vulnerability Database

National Vulnerability Database

National Vulnerability

CVE-2006-6101 Detail


Integer overflow in the ProcRenderAddGlyphs function in the Render extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local users to execute arbitrary code via a crafted X protocol request that triggers memory corruption during processing of glyph management data structures.

Source:  MITRE      Last Modified:  12/31/2006

Quick Info

CVE Dictionary Entry:
Original release date:
Last revised:


CVSS Severity (version 2.0):
CVSS v2 Base Score:
(AV:L/AC:M/Au:S/C:C/I:C/A:C) (legend)
Impact Subscore:
Exploitability Subscore:
CVSS Version 2 Metrics:
Access Vector:
Locally exploitable
Access Complexity:
Required to exploit
Impact Type:
Provides administrator access, Allows complete confidentiality, integrity, and availability violation; Allows unauthorized disclosure of information; Allows disruption of service

Vendor Statements (disclaimer)

Official Statement from Red Hat (03/14/2007)

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to

Hyperlink Resource Type Source Name External Source NETBSD NetBSD-SA2007-002 External Source HP SSRT071295 Patch; Vendor Advisory External Source IDEFENSE 20070109 Multiple Vendor X Server Render Extension ProcRenderAddGlyphs Memory Corruption Vulnerability Patch; Vendor Advisory External Source MLIST [x-org announce] 20070109 X.Org Security Advisory: multiple integer overflows in dbe and render extensions External Source GENTOO GLSA-200701-25 External Source SECTRACK 1017495 External Source SLACKWARE SSA:2007-066-02 External Source SUNALERT 102803 External Source CONFIRM External Source CONFIRM External Source MANDRIVA MDKSA-2007:005 External Source SUSE SUSE-SA:2007:008 External Source REDHAT RHSA-2007:0002 External Source REDHAT RHSA-2007:0003 External Source BID 21968 External Source UBUNTU USN-403-1 External Source VUPEN ADV-2007-0108 External Source VUPEN ADV-2007-0109 External Source VUPEN ADV-2007-0589 External Source VUPEN ADV-2007-0669 External Source VUPEN ADV-2007-2233 External Source XF xorg-xserver-render-overflow(31337) External Source CONFIRM External Source OVAL oval:org.mitre.oval:def:10490 External Source DEBIAN DSA-1249

References to Check Content

Check System:

Technical Details

Vulnerability Type (View All)

Change History 5 change records found - show changes