CVE-2008-2362 Integer overflow in n/a

Critical 10.0 Published 16 Jun 2008 Updated 7 Aug 2024

Integer overflows in the X server Render extension allow attackers to execute arbitrary code via malformed gradient requests.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2008-2362?

CVE-2008-2362 is a critical vulnerability in n/a, published on 16 Jun 2008. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Multiple integer overflows in the Render extension in the X server 1.4 in X.Org X11R7.3 allow context-dependent attackers to execute arbitrary code via a (1) SProcRenderCreateLinearGradient, (2) SProcRenderCreateRadialGradient, or (3) SProcRenderCreateConicalGradient request with an invalid field specifying the number of bytes to swap in the request data, which triggers heap memory corruption.

Weakness: CWE-189

Which versions are affected by CVE-2008-2362?

It affects 1 product.

Products include X X11.

How do I fix CVE-2008-2362?

Apply the vendor's patch.

Is CVE-2008-2362 being exploited?

There is no known exploitation of CVE-2008-2362 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2008-2362, GHSA-5qg4-c78v-h6f8.