CVE-2014-0211

Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges (CVE-2014-0209).

Ilja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially-crafted data that could cause libXfont to crash, or possibly execute arbitrary code (CVE-2014-0210, CVE-2014-0211).

These are all security issues fixed in the libXfont-devel-1.5.2-1.1 package on the GA media of openSUSE Tumbleweed.

xorg-x11-libs was patched to fix the following security issues:

* Integer overflow of allocations in font metadata file parsing.
  (CVE-2014-0209)
* libxfont not validating length fields when parsing xfs protocol
  replies. (CVE-2014-0210)
* Integer overflows causing miscalculating memory needs for xfs
  replies. (CVE-2014-0211)

Further information is available at http://lists.x.org/archives/xorg-announce/2014-May/002431.html http://lists.x.org/archives/xorg-announce/2014-May/002431.html .

Security Issues references:

* CVE-2014-0209
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0209>
* CVE-2014-0210
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0210>
* CVE-2014-0211
  <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0211>

Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.

Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges. (CVE-2014-0209)

Ilja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially-crafted data that could cause libXfont to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.10. (CVE-2014-0210, CVE-2014-0211)