CVE ID:	CVE-2007-4990
Description:	The swap_char2b function in X.Org X Font Server (xfs) before 1.0.5 allows context-dependent attackers to execute arbitrary code via (1) QueryXBitmaps and (2) QueryXExtents protocol requests with crafted size values that specify an arbitrary number of bytes to be swapped on the heap, which triggers heap corruption.
Test IDs:	1.3.6.1.4.1.25623.1.0.59996
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2007-4990 http://lists.apple.com/archives/security-announce/2008/Mar/msg00001.html BugTraq ID: 25898 http://www.securityfocus.com/bid/25898 Bugtraq: 20071003 rPSA-2007-0205-1 xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs (Google Search) http://www.securityfocus.com/archive/1/481432/100/0/threaded https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00352.html http://security.gentoo.org/glsa/glsa-200710-11.xml HPdes Security Advisory: HPSBUX02303 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01323725 HPdes Security Advisory: SSRT071468 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01323725 http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=602 http://www.mandriva.com/security/advisories?name=MDKSA-2007:210 http://lists.freedesktop.org/archives/xorg-announce/2007-October/000416.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11599 RedHat Security Advisories: RHSA-2008:0029 http://www.redhat.com/support/errata/RHSA-2008-0029.html RedHat Security Advisories: RHSA-2008:0030 http://www.redhat.com/support/errata/RHSA-2008-0030.html http://www.securitytracker.com/id?1018763 http://secunia.com/advisories/27040 http://secunia.com/advisories/27052 http://secunia.com/advisories/27060 http://secunia.com/advisories/27176 http://secunia.com/advisories/27228 http://secunia.com/advisories/27240 http://secunia.com/advisories/27560 http://secunia.com/advisories/28004 http://secunia.com/advisories/28514 http://secunia.com/advisories/28536 http://secunia.com/advisories/28542 http://secunia.com/advisories/29420 http://sunsolve.sun.com/search/document.do?assetkey=1-26-103114-1 http://sunsolve.sun.com/search/document.do?assetkey=1-66-200642-1 SuSE Security Announcement: SUSE-SA:2007:054 (Google Search) http://www.novell.com/linux/security/advisories/2007_54_xorg.html http://www.vupen.com/english/advisories/2007/3337 http://www.vupen.com/english/advisories/2007/3338 http://www.vupen.com/english/advisories/2007/3467 http://www.vupen.com/english/advisories/2008/0149 http://www.vupen.com/english/advisories/2008/0924/references XForce ISS Database: xfs-queryxbitmaps-queryxextents-bo(36920) https://exchange.xforce.ibmcloud.com/vulnerabilities/36920