Memory disclosure or crash via malformed modifier map

Out-of-bounds read in the X.Org X server on Red Hat Enterprise Linux allows local users with X11 access to disclose memory or crash the server. CheckModifierMap processes client-supplied wire data in a loop without verifying that enough request bytes remain, so the key count can exceed the supplied modifier-map data and read uninitialized memory beyond the request buffer. Exploitation requires access to the X11 server but no user interaction; the bounded outcomes are memory disclosure and an X server crash.