Multiple integer overflows in X.org libXext 1.3.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XcupGetReservedColormapEntries (2) XcupStoreColors (3) XdbeGetVisualInfo (4) XeviGetVisualInfo (5) XShapeGetRectangles and (6) XSyncListSystemCounters functions.