{"id":"CVE-2015-1802","aliases":["DEBIAN-CVE-2015-1802","DLA-183-1","DSA-3194-1","EUVD-2015-1927","GHSA-f3m3-9rj4-h5hq","MGASA-2015-0113","RHSA-2015:1708","SUSE-SU-2015:0674-1","SUSE-SU-2015:0702-1","UBUNTU-CVE-2015-1802","USN-2536-1","openSUSE-SU-2024:10299-1"],"status":"published","title":"The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x...","description":"The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.","severity":{"version":"2.0","score":8.5,"vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04886,"percentile":0.92133,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2014-05-15T16:30:57Z","modified":"2026-09-09T06:47:20Z","fixes":[{"ecosystem":"Debian:12","package":"libxfont","fixed_in":["1:1.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxfont","fixed_in":["1:1.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxfont","fixed_in":["1:1.5.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxfont","fixed_in":["1:1.4.7-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.1-5+deb6u1"}]}],"versions":["1:1.4.1-2","1:1.4.1-3","1:1.4.1-4","1:1.4.1-5"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.5-5"}]}],"versions":["1:1.4.5-2","1:1.4.5-3","1:1.4.5-4"],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1.2.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.ael7b_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.ael7b_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.ael7b_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.7-1ubuntu0.2"}]}],"versions":["1:1.4.6-1","1:1.4.6-1ubuntu1","1:1.4.7-1","1:1.4.7-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.7-1ubuntu0.2"}]}],"versions":["1:1.4.6-1","1:1.4.6-1ubuntu1","1:1.4.7-1","1:1.4.7-1ubuntu0.1"],"bundled":3}],"products":[{"vendor":"x","product":"libxfont"}],"references":[{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201507-21","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/73277","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2536-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152838.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1708.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1031935","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152497.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3194","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:145","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","article"]},{"url":"http://advisories.mageia.org/MGASA-2015-0113.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1802","tags":["advisory"]},{"url":"http://www.x.org/wiki/Development/Security/Advisory-2015-03-17"},{"url":"https://github.com/advisories/GHSA-f3m3-9rj4-h5hq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1802","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0113.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15511","tags":["report"]},{"url":"http://lists.x.org/archives/xorg-announce/2015-March/002550.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1708","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203719","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1708.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1802","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1803","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1804","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1804","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150674-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/815451","tags":["report"]},{"url":"https://bugzilla.suse.com/821663","tags":["report"]},{"url":"https://bugzilla.suse.com/854915","tags":["report"]},{"url":"https://bugzilla.suse.com/857544","tags":["report"]},{"url":"https://bugzilla.suse.com/921978","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1804","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150702-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-1802","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/03/17/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2536-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-1803","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1804","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2895","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-1802","description":"The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.","status":"published","published":"2015-03-20T14:00:00Z","modified":"2024-08-06T04:54:16.071Z","updated_at":"2026-11-02T14:35:44.046042Z"}],"euvd":[{"id":"EUVD-2015-1927","description":"The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.","status":"published","published":"2015-03-20T14:00:00Z","modified":"2024-08-06T04:54:16Z","updated_at":"2026-11-03T02:22:14.212001Z"}],"ghsa":[{"id":"GHSA-f3m3-9rj4-h5hq","title":"The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x...","description":"The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.","status":"published","published":"2022-05-17T03:20:32Z","modified":"2025-04-12T12:47:23Z","cwes":["CWE-119"],"updated_at":"2026-11-02T15:01:21.34906Z"}],"nvd":[{"id":"CVE-2015-1802","description":"The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.","status":"published","published":"2015-03-20T14:59:00.093Z","modified":"2026-06-17T00:23:01.85Z","cvss":[{"version":"2.0","score":8.5,"vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:03.313464Z"}],"osv":[{"id":"CVE-2015-1802","description":"The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.","status":"published","published":"2015-03-20T14:59:00Z","modified":"2026-04-16T06:21:02.366503733Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-1802","description":"The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.","status":"published","published":"2015-03-20T14:59:00.093Z","modified":"2026-09-09T06:47:20.898141448Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-183-1","title":"libxfont - security update","status":"published","published":"2015-03-28T00:00:00Z","modified":"2026-03-09T01:21:14.128938Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-3194-1","title":"libxfont - security update","status":"published","published":"2015-03-17T00:00:00Z","modified":"2026-03-09T01:18:56.55718Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0113","title":"Updated libxfont package fixes security vulnerabilities","description":"The bdf parser reads a count for the number of properties defined in\na font from the font file, and allocates arrays with entries for each\nproperty based on that count.  It never checked to see if that count\nwas negative, or large enough to overflow when multiplied by the size\nof the structures being allocated, and could thus allocate the wrong\nbuffer size, leading to out of bounds writes (CVE-2015-1802).\n\nIf the bdf parser failed to parse the data for the bitmap for any\ncharacter, it would proceed with an invalid pointer to the bitmap\ndata and later crash when trying to read the bitmap from that pointer\n(CVE-2015-1803).\n\nThe bdf parser read metrics values as 32-bit integers, but stored\nthem into 16-bit integers.  Overflows could occur in various operations\nleading to out-of-bounds memory access (CVE-2015-1804).\n","status":"published","published":"2015-03-23T23:58:37Z","modified":"2026-04-16T06:25:38.830120336Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10299-1","title":"libXfont-devel-1.5.2-1.1 on GA media","description":"These are all security issues fixed in the libXfont-devel-1.5.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:19:21.637303Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:1708","title":"Red Hat Security Advisory: libXfont security update","status":"published","published":"2024-09-15T22:51:35Z","modified":"2026-06-27T10:03:02Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-SU-2015:0674-1","title":"Security update for xorg-x11-libs","description":"\nxorg-x11-libs was patched to fix the following security issues:\n\n    * Integer overflow of allocations in font metadata file parsing.\n      (CVE-2014-0209)\n    * libxfont not validating length fields when parsing xfs protocol\n      replies. (CVE-2014-0210)\n    * Integer overflows causing miscalculating memory needs for xfs\n      replies. (CVE-2014-0211)\n\nFurther information is available at \nhttp://lists.x.org/archives/xorg-announce/2014-May/002431.html\n\u003chttp://lists.x.org/archives/xorg-announce/2014-May/002431.html\u003e .\n\nSecurity Issues references:\n\n    * CVE-2014-0209\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0209\u003e\n    * CVE-2014-0210\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0210\u003e\n    * CVE-2014-0211\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0211\u003e\n\n","status":"published","published":"2014-05-15T16:30:57Z","modified":"2026-02-04T03:44:30.540444Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0702-1","title":"Security update for libXfont","description":"\nLibXFont was updated to fix security problems.\n\nFollowing security issues were fixed:\n- CVE-2015-1802: The bdf parser reads a count for the number of properties\n  defined in a font from the font file, and allocates arrays with entries for each\n  property based on that count. It never checked to see if that count\n  was negative, or large enough to overflow when multiplied by the size\n  of the structures being allocated, and could thus allocate the wrong\n  buffer size, leading to out of bounds writes.\n\n- CVE-2015-1803: If the bdf parser failed to parse the data for the bitmap for any\n  character, it would proceed with an invalid pointer to the bitmap\n  data and later crash when trying to read the bitmap from that pointer.\n\n- CVE-2015-1804: The bdf parser read metrics values as 32-bit integers, but stored\n  them into 16-bit integers. Overflows could occur in various operations\n  leading to out-of-bounds memory access. \n","status":"published","published":"2015-03-20T15:39:51Z","modified":"2026-02-04T03:14:42.831133Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-1802","description":"The bdfReadProperties function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 allows remote authenticated users to cause a denial of service (out-of-bounds write and crash) or possibly execute arbitrary code via a (1) negative or (2) large property count in a BDF font file.","status":"published","published":"2015-03-18T00:00:00Z","modified":"2026-04-22T10:03:31.558252Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2536-1","title":"libxfont vulnerabilities","description":"Ilja van Sprundel, Alan Coopersmith, and William Robinet discovered that\nlibXfont incorrectly handled malformed bdf fonts. A local attacker could\nuse this issue to cause libXfont to crash, or possibly execute arbitrary\ncode in order to gain privileges.\n","status":"published","published":"2015-03-18T14:45:53Z","modified":"2026-04-22T09:09:38.206403Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}