Bug 582601 (CVE-2010-1166) - CVE-2010-1166 Xorg: X server Render extension memory corruption
Summary: CVE-2010-1166 Xorg: X server Render extension memory corruption
Alias: CVE-2010-1166
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Nobody
QA Contact:
Depends On: 495733 582651
TreeView+ depends on / blocked
Reported: 2010-04-15 12:04 UTC by Tomas Hoger
Modified: 2023-07-07 08:35 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2010:0382 0 normal SHIPPED_LIVE Important: xorg-x11-server security update 2010-04-28 12:06:34 UTC

Description Tomas Hoger 2010-04-15 12:04:32 UTC
A memory corruption flaw was discovered in Xorg X server's Render extension.  Problem originally reported as Firefox crashing X server issue was tracked down to an incorrect calculation issue in mod() macro by Olivier Fourdan:


This issue could cause mod() to return value greater than its second argument (the divisor), resulting in excessive read and write in Render composite operation, causing heap or video memory corruption.

Comment 1 Tomas Hoger 2010-04-15 12:11:52 UTC
mod() macro has the same definition in Xorg and XFree86 in Red Hat Enterprise Linux 4 and Red Hat Enterprise Linux 3 respectively, but in those versions, no expression is used as the first operand (the dividend).

The expression causing incorrect calculation was added upstream via:

Comment 2 Tomas Hoger 2010-04-15 12:33:38 UTC
In current X server versions, there is similar issue in fbWalkCompositeRegion.  However, it does not seem to be called in the current code.  It was previous called from fbComposite:


but it does not call it any more.

Comment 5 Josh Bressers 2010-04-28 11:33:38 UTC
Removing embargo

Comment 6 errata-xmlrpc 2010-04-28 12:06:37 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2010:0382 https://rhn.redhat.com/errata/RHSA-2010-0382.html

Note You need to log in before you can comment on or make changes to this bug.