Published: 15/05/2014 Updated: 09/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Multiple buffer overflows in X.Org libXfont prior to 1.4.8 and 1.4.9x prior to 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.

Vulnerable Product	Search on Vulmon	Subscribe to Product
x libxfont 1.2.8
x libxfont 1.2.9
x libxfont 1.4.2
x libxfont 1.4.3
x libxfont 1.2.4
x libxfont 1.2.5
x libxfont 1.3.2
x libxfont 1.3.3
x libxfont 1.3.4
x libxfont 1.4.6
x libxfont
x libxfont 1.2.6
x libxfont 1.2.7
x libxfont 1.4.0
x libxfont 1.4.1
x libxfont 1.4.99
x libxfont 1.2.3
x libxfont 1.3.0
x libxfont 1.3.1
x libxfont 1.4.4
x libxfont 1.4.5
canonical ubuntu linux 12.04
canonical ubuntu linux 12.10
canonical ubuntu linux 10.04
canonical ubuntu linux 13.10
canonical ubuntu linux 14.04

Several security issues were fixed in libXfont ...

Ilja van Sprundel of IOActive discovered several security issues in the XOrg libXfont library, which may allow a local, authenticated user to attempt to raise privileges; or a remote attacker who can control the font server to attempt to execute code with the privileges of the X server CVE-2014-0209 Integer overflow of allocations in font me ...

Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in XOrg libXfont before 148 and 149x before 1499901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow Multiple buffer overflows in XOrg libXfont before 148 and 149x ...

Multiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an Xorg font server A malicious Xorg server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the XOrg server ...

CWE-119 http://www.debian.org/security/2014/dsa-2927 http://lists.x.org/archives/xorg-announce/2014-May/002431.html http://www.ubuntu.com/usn/USN-2211-1 http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html http://rhn.redhat.com/errata/RHSA-2014-1893.html http://www.vmware.com/security/advisories/VMSA-2014-0012.html http://seclists.org/fulldisclosure/2014/Dec/23 http://www.mandriva.com/security/advisories?name=MDVSA-2015:145 http://advisories.mageia.org/MGASA-2014-0278.html http://www.securityfocus.com/bid/67382 http://secunia.com/advisories/59154 http://www.securityfocus.com/archive/1/534161/100/0/threaded https://usn.ubuntu.com/2211-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2014-0210

CVE-2014-0210

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect