← Vulnerability feed

Vulnerability record · CVE-2006-3740 · published 13 September 2006

CVE-2006-3740: X.org vulnerability

XX.Org · X.Org

Integer overflow in the scan_cidfont function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted (1) CMap and (2) CIDFont font data with modified item counts in the (a) begincodespacerange, (b) cidrange, and (c) notdefrange sections.

7.2 CVSS 2.0 High EPSS 0.52% · top 58.2%
7.2CVSS 2.0 base score
0.52%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
78References
16 Jun 2026Last modified by NVD

Description

Integer overflow in the scan_cidfont function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted (1) CMap and (2) CIDFont font data with modified item counts in the (a) begincodespacerange, (b) cidrange, and (c) notdefrange sections.

AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/21864
http://secunia.com/advisories/21889
http://secunia.com/advisories/21890
http://secunia.com/advisories/21894
http://secunia.com/advisories/21900
http://secunia.com/advisories/21904
http://secunia.com/advisories/21908
http://secunia.com/advisories/21924
http://secunia.com/advisories/22080
http://secunia.com/advisories/22141
http://secunia.com/advisories/22332
http://secunia.com/advisories/22560
http://secunia.com/advisories/23033
http://secunia.com/advisories/23899
http://secunia.com/advisories/23907
http://secunia.com/advisories/24636
http://security.gentoo.org/glsa/glsa-200609-07.xml
http://securitytracker.com/id?1016828
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102780-1
http://support.avaya.com/elmodocs2/security/ASA-2006-190.htm
http://support.avaya.com/elmodocs2/security/ASA-2006-191.htm
http://www.debian.org/security/2006/dsa-1193
http://www.idefense.com/intelligence/vulnerabilities/display.php?id=411 PatchVendor Advisory
http://www.mandriva.com/security/advisories?name=MDKSA-2006:164
http://www.novell.com/linux/security/advisories/2006_23_sr.html
http://www.redhat.com/support/errata/RHSA-2006-0665.html PatchVendor Advisory
http://www.redhat.com/support/errata/RHSA-2006-0666.html PatchVendor Advisory
http://www.securityfocus.com/archive/1/445812/100/0/threaded
http://www.securityfocus.com/archive/1/464268/100/0/threaded
http://www.securityfocus.com/bid/19974
http://www.ubuntu.com/usn/usn-344-1
http://www.vmware.com/support/esx25/doc/esx-254-200702-patch.html
http://www.vupen.com/english/advisories/2006/3581
http://www.vupen.com/english/advisories/2006/3582
http://www.vupen.com/english/advisories/2007/0322
http://www.vupen.com/english/advisories/2007/1171
https://exchange.xforce.ibmcloud.com/vulnerabilities/28890
https://issues.rpath.com/browse/RPL-614
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9454
http://secunia.com/advisories/21864

Track CVE-2006-3740 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2006-6102X.org vulnerabilityInteger overflow in the ProcDbeGetVisualInfo function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local u…EPSS 3.4%8.5CVE-2010-4818X.org improper input validation vulnerabilityThe GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary…EPSS 5.3%7.2CVE-2006-3739X.org vulnerabilityInteger overflow in the CIDAFM function in X.Org 6.8.2 and XFree86 X server allows local users to execute arbitrary code via crafted Adobe Font Metri…EPSS 0.59%6.6CVE-2006-6101X.org vulnerabilityInteger overflow in the ProcRenderAddGlyphs function in the Render extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local…EPSS 0.38%6.6CVE-2006-6103X.org vulnerabilityInteger overflow in the ProcDbeSwapBuffers function in the DBE extension for X.Org 6.8.2, 6.9.0, 7.0, and 7.1, and XFree86 X server, allows local use…EPSS 0.38%5.0CVE-2006-0197X.org vulnerabilityThe XClientMessageEvent struct used in certain components of X.Org 6.8.2 and earlier, possibly including (1) the X server and (2) Xlib, uses a "long"…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2006-3740), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.