CVE-2010-1166
The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1...
CVE-2010-1166 is a high vulnerability (CVSS 7.1) in X X.org, published April 29, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.35%, the 92nd percentile. Fixed in xorg-x11-server 0:1.1.1-48.76.el5_5.1.
- Severity
- 7.1 HighCVSS 2.0, NVD
- Exploit chance
- 5.35%EPSS, 92nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0:1.1.1-48.76.el5_5.1xorg-x11-server +19 more
Description
The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xorg-x11-serverRed Hat:enterprise_linux:5::client_workstation | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-debuginfoRed Hat:enterprise_linux:5::client_workstation | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-sdkRed Hat:enterprise_linux:5::client_workstation | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-serverRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-XdmxRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-XephyrRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-XnestRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-XorgRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-XvfbRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-Xvnc-sourceRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
xorg-x11-server-debuginfoRed Hat:enterprise_linux:5::client | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-serverRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-XdmxRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-XephyrRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-XnestRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-XorgRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-XvfbRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-Xvnc-sourceRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-debuginfoRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
xorg-x11-server-sdkRed Hat:enterprise_linux:5::server | before 0:1.1.1-48.76.el5_5.1 | 0:1.1.1-48.76.el5_5.1 |
What each source reports
NVD Score used
The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.
- Record
CVE-2010-1166- CVSS 2.0
- 7.1 High
AV:N/AC:H/Au:S/C:C/I:C/A:C - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE ListNo score
The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.
- Record
CVE-2010-1166- Updated
- 2026-11-02
EUVDEUVD-2010-1196No score
The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.
- Record
EUVD-2010-1196- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r2w8-jwh3-x7vcNo score
The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1...
The fbComposite function in fbpict.c in the Render extension in the X server in X.Org X11R7.1 allows remote authenticated users to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted request, related to an incorrect macro definition.
- Record
GHSA-r2w8-jwh3-x7vc- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rhn.redhat.com/errata/RHSA-2010-0382.html
securitytracker.com/id?1023929
secunia.com/advisories/39650
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10112
cgit.freedesktop.org/xorg/xserver/commit?id=d2f813f7db
Show 12 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=495733
lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
vupen.com/english/advisories/2010/1185
ubuntu.com/usn/USN-939-1
nvd.nist.gov/vuln/detail/CVE-2010-1166
access.redhat.com/errata/RHSA-2010:0382
github.com/advisories/GHSA-r2w8-jwh3-x7vc
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0382.json
cve.org/CVERecord?id=CVE-2010-1166