[Quote:]

During the analysis of results from the Coverity code review of X.Org, we discovered a flaw in the server that allows local users to execute arbitrary code with root privileges, or cause a denial of service by overwriting files on the system, again with root privileges.

To show you how simple such a mistake can be, here’s one of the two instances of the mistake:

if (!strcmp(argv[i], "-configure"))
{
  if (getuid() != 0 && geteuid == 0) {
   ErrorF("The '-configure' option can only be used by root.\n");
   exit(1);
  }
}

did you spot the mistake?

If not, here’s the corrected code:

if (!strcmp(argv[i], "-configure"))
{
  if (getuid() != 0 && geteuid() == 0) {
   ErrorF("The '-configure' option can only be used by root.\n");
   exit(1);
  }
}