Referenced CVEs:
CVE-2007-5760, CVE-2007-5958, CVE-2007-6427, CVE-2007-6428, CVE-2007-6429, CVE-2008-0006


Description:
=========================================================== Ubuntu Security Notice USN-571-1 January 18, 2008libxfont, xorg-server vulnerabilitiesCVE-2007-5760, CVE-2007-5958, CVE-2007-6427, CVE-2007-6428,CVE-2007-6429, CVE-2008-0006===========================================================A security issue affects the following Ubuntu releases:Ubuntu 6.06 LTSUbuntu 6.10Ubuntu 7.04Ubuntu 7.10This advisory also applies to the corresponding versions ofKubuntu, Edubuntu, and Xubuntu.The problem can be corrected by upgrading your system to thefollowing package versions:Ubuntu 6.06 LTS: libxfont1 1:1.0.0-0ubuntu3.4 xserver-xorg-core 1:1.0.2-0ubuntu10.8Ubuntu 6.10: libxfont1 1:1.2.0-0ubuntu3.2 xserver-xorg-core 1:1.1.1-0ubuntu12.3Ubuntu 7.04: libxfont1 1:1.2.7-1ubuntu1.1 xserver-xorg-core 2:1.2.0-3ubuntu8.1Ubuntu 7.10: libxfont1 1:1.3.0-0ubuntu1.1 xserver-xorg-core 2:1.3.0.0.dfsg-12ubuntu8.1After a standard system upgrade you need to restart your session to effectthe necessary changes.Details follow:Multiple overflows were discovered in the XFree86-Misc, XInput-Misc,TOG-CUP, EVI, and MIT-SHM extensions which did not correctly validatefunction arguments. An authenticated attacker could send speciallycrafted requests and gain root privileges. (CVE-2007-5760, CVE-2007-6427,CVE-2007-6428, CVE-2007-6429)It was discovered that the X.org server did not use user privileges whenattempting to open security policy files. Local attackers could exploitthis to probe for files in directories they would not normally be ableto access. (CVE-2007-5958)It was discovered that the PCF font handling code did not correctlyvalidate the size of fonts. An authenticated attacker could load aspecially crafted font and gain additional privileges. (CVE-2008-0006)





More...