It was found that when receiving a response from the server protocol data is not validated sufficiently. Individual lengths inside received server data can overflow the previously reserved memory. Upstream patch: https://cgit.freedesktop.org/xorg/lib/libXrender/commit/?id=9362c7ddd1af3b168953d0737877bc52d79c94f4 External References: https://lists.x.org/archives/xorg-announce/2016-October/002720.html CVE assignment: http://seclists.org/oss-sec/2016/q4/17
Created libXrender tracking bugs for this issue: Affects: fedora-all [bug 1381930]