libX11.so is vulnerable to an out-of-bounds write. This is due to the length value in XGetFontPath
and XListExtensions
being interpreted as a signed character on different systems, which can lead to an out-of-bounds write of up to 128 bytes in front of the allocated storage.