{"id":"CVE-2015-1804","aliases":["DEBIAN-CVE-2015-1804","DLA-183-1","DSA-3194-1","EUVD-2015-1929","GHSA-78q2-gpgm-j9wf","MGASA-2015-0113","RHSA-2015:1708","SUSE-RU-2015:2393-1","SUSE-RU-2016:0031-1","SUSE-SU-2015:0674-1","SUSE-SU-2015:0702-1","UBUNTU-CVE-2015-1804","USN-2536-1","openSUSE-SU-2024:10299-1"],"status":"published","title":"The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x...","description":"The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.","severity":{"version":"2.0","score":8.5,"vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04945,"percentile":0.92218,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-189"],"published":"2014-05-15T16:30:57Z","modified":"2026-09-09T06:47:32Z","fixes":[{"ecosystem":"Debian:12","package":"libxfont","fixed_in":["1:1.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libxfont","fixed_in":["1:1.5.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libxfont","fixed_in":["1:1.5.1-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"xorg-x11-libs","fixed_in":["7.4-8.26.46.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xorg-x11-libs","fixed_in":["7.4-8.26.46.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"xorg-x11-libs","fixed_in":["7.4-8.26.46.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"xorg-x11-libs","fixed_in":["7.4-8.26.46.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"xorg-x11-libs","fixed_in":["7.4-8.26.46.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"xorg-x11-libs","fixed_in":["7.4-8.26.46.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"xorg-x11-libs","fixed_in":["7.4-8.26.46.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xorg-x11-libs","fixed_in":["7.4-8.26.46.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xorg-x11-libs","fixed_in":["7.4-8.26.46.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libXfont","fixed_in":["1.4.7-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libXfont","fixed_in":["1.4.7-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libXfont","fixed_in":["1.4.7-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libXfont","fixed_in":["1.4.7-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"libXfont","fixed_in":["1.4.7-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libXfont","fixed_in":["1.4.7-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libXfont","fixed_in":["1.4.7-7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libXfont","fixed_in":["1.4.7-7.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"libxfont","fixed_in":["1:1.4.7-1ubuntu0.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.5.1-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.1-5+deb6u1"}]}],"versions":["1:1.4.1-2","1:1.4.1-3","1:1.4.1-4","1:1.4.1-5"],"bundled":3},{"source":"osv","ecosystem":"Debian:7","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.5-5"}]}],"versions":["1:1.4.5-2","1:1.4.5-3","1:1.4.5-4"],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-1.2.mga4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.5-5.el6_7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.ael7b_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.ael7b_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.ael7b_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libXfont-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libXfont-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.7-3.el7_1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP3","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.46.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.46.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP3","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.46.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 11 SP4","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.46.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.46.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.46.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP3","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.46.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.46.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"xorg-x11-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-8.26.46.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"libXfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.7-4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.7-1ubuntu0.2"}]}],"versions":["1:1.4.6-1","1:1.4.6-1ubuntu1","1:1.4.7-1","1:1.4.7-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"libxfont","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.4.7-1ubuntu0.2"}]}],"versions":["1:1.4.6-1","1:1.4.6-1ubuntu1","1:1.4.7-1","1:1.4.7-1ubuntu0.1"],"bundled":3}],"products":[{"vendor":"x","product":"libxfont"}],"references":[{"url":"http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201507-21","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-12/msg00074.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.ubuntu.com/usn/USN-2536-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152838.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-1708.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00032.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1031935","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152497.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3194","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:145","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://www.x.org/wiki/Development/Security/Advisory-2015-03-17/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","article"]},{"url":"http://advisories.mageia.org/MGASA-2015-0113.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/73279","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00005.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1804","tags":["advisory"]},{"url":"http://www.x.org/wiki/Development/Security/Advisory-2015-03-17"},{"url":"https://github.com/advisories/GHSA-78q2-gpgm-j9wf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1804","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0113.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15511","tags":["report"]},{"url":"http://lists.x.org/archives/xorg-announce/2015-March/002550.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:1708","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1203719","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_1708.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1802","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1802","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1803","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1803","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-1804","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1804","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20152393-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/958383","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1804","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-20160031-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150674-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/815451","tags":["report"]},{"url":"https://bugzilla.suse.com/821663","tags":["report"]},{"url":"https://bugzilla.suse.com/854915","tags":["report"]},{"url":"https://bugzilla.suse.com/857544","tags":["report"]},{"url":"https://bugzilla.suse.com/921978","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1985","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1991","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-6462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1803","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150702-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-1804","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/03/17/5","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2536-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-1802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1803","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2895","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-1804","description":"The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.","status":"published","published":"2015-03-20T14:00:00Z","modified":"2024-08-06T04:54:16.301Z","updated_at":"2026-11-02T14:35:43.698357Z"}],"euvd":[{"id":"EUVD-2015-1929","description":"The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.","status":"published","published":"2015-03-20T14:00:00Z","modified":"2024-08-06T04:54:16Z","updated_at":"2026-11-03T02:22:14.212001Z"}],"ghsa":[{"id":"GHSA-78q2-gpgm-j9wf","title":"The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x...","description":"The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.","status":"published","published":"2022-05-17T03:12:24Z","modified":"2025-04-12T12:47:23Z","updated_at":"2026-11-02T15:01:21.34906Z"}],"nvd":[{"id":"CVE-2015-1804","description":"The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.","status":"published","published":"2015-03-20T14:59:03.403Z","modified":"2026-06-17T00:23:02.16Z","cvss":[{"version":"2.0","score":8.5,"vector":"AV:N/AC:M/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-189"],"updated_at":"2026-11-02T14:03:03.313464Z"}],"osv":[{"id":"CVE-2015-1804","description":"The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.","status":"published","published":"2015-03-20T14:59:03Z","modified":"2026-04-16T06:18:11.635936147Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-1804","description":"The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.","status":"published","published":"2015-03-20T14:59:03.403Z","modified":"2026-09-09T06:47:32.125519618Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"DLA-183-1","title":"libxfont - security update","status":"published","published":"2015-03-28T00:00:00Z","modified":"2026-03-09T01:21:14.128938Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-3194-1","title":"libxfont - security update","status":"published","published":"2015-03-17T00:00:00Z","modified":"2026-03-09T01:18:56.55718Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0113","title":"Updated libxfont package fixes security vulnerabilities","description":"The bdf parser reads a count for the number of properties defined in\na font from the font file, and allocates arrays with entries for each\nproperty based on that count.  It never checked to see if that count\nwas negative, or large enough to overflow when multiplied by the size\nof the structures being allocated, and could thus allocate the wrong\nbuffer size, leading to out of bounds writes (CVE-2015-1802).\n\nIf the bdf parser failed to parse the data for the bitmap for any\ncharacter, it would proceed with an invalid pointer to the bitmap\ndata and later crash when trying to read the bitmap from that pointer\n(CVE-2015-1803).\n\nThe bdf parser read metrics values as 32-bit integers, but stored\nthem into 16-bit integers.  Overflows could occur in various operations\nleading to out-of-bounds memory access (CVE-2015-1804).\n","status":"published","published":"2015-03-23T23:58:37Z","modified":"2026-04-16T06:25:38.830120336Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10299-1","title":"libXfont-devel-1.5.2-1.1 on GA media","description":"These are all security issues fixed in the libXfont-devel-1.5.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:19:21.637303Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"RHSA-2015:1708","title":"Red Hat Security Advisory: libXfont security update","status":"published","published":"2024-09-15T22:51:35Z","modified":"2026-06-27T10:03:02Z","updated_at":"2026-11-02T15:53:03.182161Z"},{"id":"SUSE-RU-2015:2393-1","title":"Recommended update for xorg-x11-libs","description":"\nThis update for xorg-x11-libs fixes the following issues: \n\n- The original fix for CVE-2015-1804 prevented DWIDTH to be negative. However, the\n  spec states that 'DWIDTH [...] is a vector indicating the position of the next\n  glyph's origin relative to the origin of this glyph'. Consequently, negative \n  DWIDTH values should be allowed. (bsc#958383)\n","status":"published","published":"2015-12-29T12:56:29Z","modified":"2026-02-04T04:38:57.452856Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2016:0031-1","title":"Recommended update for libXfont","description":"\nThis update for libXfont fixes the following issues:\n\n- The original fix for CVE-2015-1804 prevented DWIDTH to be negative. However, the\n  spec states that 'DWIDTH [...] is a vector indicating the position of the next\n  glyph's origin relative to the origin of this glyph'. Consequently, negative\n  DWIDTH values should be allowed. (bsc#958383)\n","status":"published","published":"2016-01-05T15:23:12Z","modified":"2026-02-04T03:25:42.005012Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0674-1","title":"Security update for xorg-x11-libs","description":"\nxorg-x11-libs was patched to fix the following security issues:\n\n    * Integer overflow of allocations in font metadata file parsing.\n      (CVE-2014-0209)\n    * libxfont not validating length fields when parsing xfs protocol\n      replies. (CVE-2014-0210)\n    * Integer overflows causing miscalculating memory needs for xfs\n      replies. (CVE-2014-0211)\n\nFurther information is available at \nhttp://lists.x.org/archives/xorg-announce/2014-May/002431.html\n\u003chttp://lists.x.org/archives/xorg-announce/2014-May/002431.html\u003e .\n\nSecurity Issues references:\n\n    * CVE-2014-0209\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0209\u003e\n    * CVE-2014-0210\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0210\u003e\n    * CVE-2014-0211\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0211\u003e\n\n","status":"published","published":"2014-05-15T16:30:57Z","modified":"2026-02-04T03:44:30.540444Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0702-1","title":"Security update for libXfont","description":"\nLibXFont was updated to fix security problems.\n\nFollowing security issues were fixed:\n- CVE-2015-1802: The bdf parser reads a count for the number of properties\n  defined in a font from the font file, and allocates arrays with entries for each\n  property based on that count. It never checked to see if that count\n  was negative, or large enough to overflow when multiplied by the size\n  of the structures being allocated, and could thus allocate the wrong\n  buffer size, leading to out of bounds writes.\n\n- CVE-2015-1803: If the bdf parser failed to parse the data for the bitmap for any\n  character, it would proceed with an invalid pointer to the bitmap\n  data and later crash when trying to read the bitmap from that pointer.\n\n- CVE-2015-1804: The bdf parser read metrics values as 32-bit integers, but stored\n  them into 16-bit integers. Overflows could occur in various operations\n  leading to out-of-bounds memory access. \n","status":"published","published":"2015-03-20T15:39:51Z","modified":"2026-02-04T03:14:42.831133Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-1804","description":"The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly perform type conversion for metrics values, which allows remote authenticated users to cause a denial of service (out-of-bounds memory access) and possibly execute arbitrary code via a crafted BDF font file.","status":"published","published":"2015-03-18T00:00:00Z","modified":"2026-04-22T10:03:45.49556Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2536-1","title":"libxfont vulnerabilities","description":"Ilja van Sprundel, Alan Coopersmith, and William Robinet discovered that\nlibXfont incorrectly handled malformed bdf fonts. A local attacker could\nuse this issue to cause libXfont to crash, or possibly execute arbitrary\ncode in order to gain privileges.\n","status":"published","published":"2015-03-18T14:45:53Z","modified":"2026-04-22T09:09:38.206403Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}