CVE-2007-6427: Apple Mac OS X

High severity, CVSS 9.3. EPSS: 4.3% chance of exploitation in the next 30 days.

The XInput extension in X.Org Xserver before 1.4.1 allows context-dependent attackers to execute arbitrary code via requests related to byte swapping and heap corruption within multiple functions, a different vulnerability than CVE-2007-4990.

Affected products

• Apple Mac OS X: before 10.4.11 (fixed in 10.4.11); from 10.5.0, before 10.5.2 (fixed in 10.5.2)
• Canonical Ubuntu Linux: version 6.06 only; version 6.10 only; version 7.04 only; version 7.10 only
• Debian Debian Linux: version 3.1 only; version 4.0 only
• Fedoraproject Fedora: version 7 only; version 8 only
• Opensuse Opensuse: version 10.2 only; version 10.3 only
• Suse Linux: version 10.1 only
• Suse Linux Enterprise Desktop: version 9 only; version 10 only
• Suse Linux Enterprise Server: version 8 only; version 9 only; version 10 only
• Suse Linux Enterprise Software Development Kit: version 10 only
• Suse Open Enterprise Server: affected versions not specified
• X.org X Server: before 1.4.1 (fixed in 1.4.1)

Published 2008-01-18. Last modified 2026-06-16.