Multiple buffer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the (1) XAllocColorCells (2) _XkbReadGetDeviceInfoReply (3) _XkbReadGeomShapes (4) _XkbReadGetGeometryReply (5) _XkbReadKeySyms (6) _XkbReadKeyActions (7) _XkbReadKeyBehaviors (8) _XkbReadModifierMap (9) _XkbReadExplicitComponents (10) _XkbReadVirtualModMap (11) _XkbReadGetNamesReply (12) _XkbReadGetMapReply (13) _XimXGetReadData (14) XListFonts (15) XListExtensions and (16) XGetFontPath functions.