1. CVE-Search
  2. CVE-2014-0209
ID CVE-2014-0209
Summary Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.
References
Vulnerable Configurations
  • cpe:2.3:a:x:libxfont:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.2.5:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.6:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.2.6:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.7:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.2.7:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.8:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.2.8:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.9:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.2.9:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.3.0:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.3.0:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.3.1:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.3.1:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.3.2:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.3.2:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.0:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.4.0:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.1:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.4.1:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.2:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.4.2:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.4:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.4.4:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.1.0:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.4.7:*:*:*:*:*:*:*
  • cpe:2.3:a:x:libxfont:1.4.99:*:*:*:*:*:*:*
    cpe:2.3:a:x:libxfont:1.4.99:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
  • cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
    cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
CVSS
Base: 4.6 (as of 09-10-2018 - 19:38)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:L/AC:L/Au:N/C:P/I:P/A:P
redhat via4
advisories
rhsa
id RHSA-2014:1893
rpms
  • libXfont-0:1.4.5-4.el6_6
  • libXfont-0:1.4.7-2.el7_0
  • libXfont-debuginfo-0:1.4.5-4.el6_6
  • libXfont-debuginfo-0:1.4.7-2.el7_0
  • libXfont-devel-0:1.4.5-4.el6_6
  • libXfont-devel-0:1.4.7-2.el7_0
  • libXfont-0:1.2.2-1.0.6.el5_11
  • libXfont-debuginfo-0:1.2.2-1.0.6.el5_11
  • libXfont-devel-0:1.2.2-1.0.6.el5_11
refmap via4
bid 67382
bugtraq 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
confirm
debian DSA-2927
fulldisc 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities
mandriva MDVSA-2015:145
mlist [xorg-announce] 20140513 [ANNOUNCE] X.Org Security Advisory: Multiple issues in libXfont
secunia 59154
suse openSUSE-SU-2014:0711
ubuntu USN-2211-1
Last major update 09-10-2018 - 19:38
Published 15-05-2014 - 14:55
Last modified 09-10-2018 - 19:38
Back to Top