Xpra is screen for X11. This is the fork located at: http://xpra.org/ Xpra versions 0.0.7.28 (r191) through to 0.0.7.34 (r443) return random chunks of memory to the clients by using the wrong size (multiplying by 4) for the X11 cursor memory buffer. (from XFixesGetCursorImage) The byte order of the data returned is only slightly off (argb -> rgba) Clients can easily trigger this bug by using X11 applications with custom cursors, potentially many times per second. However the risks should be fairly limited since Xpra and its Xvfb process typically run with the same uid as the client application they host. Thanks to 'fecund' for reporting this. Only OpenBSD terminated the process, other unices are quite happy to let you access memory beyond the end of the cursor buffer. Cheers Antoine
