The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data. http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5407
