The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors involving filter name lengths.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "low", "binaries": [ { "libxrender-dev-dbgsym": "1:0.9.9-0ubuntu1+esm1", "libxrender1-dbg": "1:0.9.9-0ubuntu1+esm1", "libxrender1-dbgsym": "1:0.9.9-0ubuntu1+esm1", "libxrender1": "1:0.9.9-0ubuntu1+esm1", "libxrender-dev": "1:0.9.9-0ubuntu1+esm1", "libxrender1-udeb-dbgsym": "1:0.9.9-0ubuntu1+esm1", "libxrender1-udeb": "1:0.9.9-0ubuntu1+esm1" } ] }