CVE-2014-0210

Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges (CVE-2014-0209).

Ilja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially-crafted data that could cause libXfont to crash, or possibly execute arbitrary code (CVE-2014-0210, CVE-2014-0211).

These are all security issues fixed in the libXfont-devel-1.5.2-1.1 package on the GA media of openSUSE Tumbleweed.

xorg-x11-libs was patched to fix the following security issues:

* Integer overflow of allocations in font metadata file parsing.
  (CVE-2014-0209)
* libxfont not validating length fields when parsing xfs protocol
  replies. (CVE-2014-0210)
* Integer overflows causing miscalculating memory needs for xfs
  replies. (CVE-2014-0211)

Further information is available at http://lists.x.org/archives/xorg-announce/2014-May/002431.html http://lists.x.org/archives/xorg-announce/2014-May/002431.html .

Security Issues references:

* CVE-2014-0209
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0209>
* CVE-2014-0210
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0210>
* CVE-2014-0211
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0211>

Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.

Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges. (CVE-2014-0209)

Ilja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially-crafted data that could cause libXfont to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.10. (CVE-2014-0210, CVE-2014-0211)