Bug 10876

See: http://www.securityfocus.com/vdb/bottom.html?vid=1113

From the discussion there:
A buffer overflow exists in in the -xbdmap parameter to the XFree86 X
Server. By passing over 2100 characters, it is possible to cause the X
server to crash. According to the author, it is vulnerable to a more
complex buffer overrun attack. The X server, at this stage, still possesses
root privileges, and as such any code executed would be with root
permissions.

The discoverer of this vulnerability notes that all shell code passed to
the overrun (which lies in an unchecked strcpy()) must be alphanumeric.
Non-alphanumeric characters are, at some point, replaced with a '_'.
However, due to the complex nature of the XServer, the discoverer
maintains that in order to complete this overflow, it may merely be
necessary to alter a pointer to cause code placed elsewhere, perhaps via
another parameter, to be executed.