Security bugs are reported here via bugzilla

["Andrew \"ruskie\" Levstik" <ruskie AT mages.ath.cx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

When parsing arguments, the server takes care to check that only root
can pass the options -modulepath, which determines the location to load
many modules providing server functionality from, and -logfile, which
determines the location of the logfile.  Normally, these locations
cannot be changed by unprivileged users.

This test was changed to test the effective UID as well as the real UID
in X.Org.  The test is defective in that it tested the address of the
geteuid function, not the result of the function itself.  As a result,
given that the address of geteuid() is always non-zero, an unpriviliged
user can load modules from any location on the filesystem with root
privileges, or overwrite critical system files with the server log.

For more details, see
http://lists.freedesktop.org/archives/xorg/2006-March/013992.html

- ---
This applies to xorg-modular grimoire.
Systems using xorg-modular grimoire should update their xorg-server
installation:
# scribe update
# cast -c xorg-server

or

# scribe update
# sorcery queue-security
# cast --queue


- -- 
Andrew "ruskie" Levstik
Source Mage GNU/Linux Games grimoire guru
Geek/Hacker/Tinker

Hacker FAQ: http://www.plethora.net/%7eseebs/faqs/hacker.html

Key id = A7A9E461
Key fingerprint = 757E C16B F5B7 DC27 B003  CCED CF95 3A77 A7A9 E461

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEIT6Yz5U6d6ep5GERAon3AJ9bCJuuQEMqO9GAvOzQ43QCmxE6dgCfaAuL
dVfVJzt1U34PIDfFbQWRgTQ=
=no2/
-----END PGP SIGNATURE-----