>>	where could i find that statement?  URL?  as far as i checked they
>>	use the same codepath therefore not fixing 3.3 seems to be a wrong
>>	thing.
>Itojun,
>As tron is listed in 3DPARTY as the responsible maintainer for the
>XFree86 codebase in xsrc, and as he has looked into the matter and
>concluded that XF86 3.x is not vulnerable (something I also seem to
>recall from the original announcement of this vulnerability), it would
>seem that _you_ should provide evidence that the codebase in question
>_is_ vulnerable before going in and modifying it this close to a
>release.
>
>Do you have any specific reason to believe that the code in question is
>vulnerable?

	try a diff between these two code.  they are identical!

itojun