JVNDB-2008-001043

Vulnerability from jvndb - Published: 2008-06-13 08:11 - Updated:2008-11-21 03:19
Severity
N/A (UNKNOWN) - -
Summary
X.Org Foundation X server buffer overflow vulnerability
Details
X server provided by the X.Org Foundation contains a buffer overflow vulnerability. The X.Org Foundation provides an open source implementation of the X Window System. The X server of this implementation contains a vulnerability in the handling of Portable Compiled Font (PCF) format fonts that can be exploited to cause a buffer overflow. X.Org Foundation released the X.Org security advisory on January 17, 2008, and CERT/CC released VU#203220 on March 19, 2008 regarding this vulnerability issue. Takuya Shiozaki of CODE blog (codeblog.org) reported this vulnerability to IPA. JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.
References
Impacted products
Show details on JVN DB website
To clipboard 

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-001043.html",
  "dc:date": "2008-11-21T12:19+09:00",
  "dcterms:issued": "2008-06-13T17:11+09:00",
  "dcterms:modified": "2008-11-21T12:19+09:00",
  "description": "X server provided by the X.Org Foundation contains a buffer overflow vulnerability. \r\n\r\nThe X.Org Foundation provides an open source implementation of the X Window System. The X server of this implementation contains a vulnerability in the handling of Portable Compiled Font (PCF) format fonts that can be exploited to cause a buffer overflow. \r\n\r\nX.Org Foundation released the X.Org security advisory on January 17, 2008, and CERT/CC released VU#203220 on March 19, 2008 regarding this vulnerability issue. \r\n\r\nTakuya Shiozaki of CODE blog (codeblog.org) reported this vulnerability to IPA. \r\nJPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2008/JVNDB-2008-001043.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:fujitsu:pc-x",
      "@product": "FUJITSU PC-X",
      "@vendor": "FUJITSU",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:suse:suse_open_enterprise_server",
      "@product": "Open Enterprise Server",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:suse:suse_sles",
      "@product": "SUSE SLES",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:x.org:x.org_x11",
      "@product": "X.Org X11",
      "@vendor": "X.Org Foundation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:xfree86_project:xfree86",
      "@product": "XFree86",
      "@vendor": "XFree86 Project",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:apple:mac_os_x",
      "@product": "Apple Mac OS X",
      "@vendor": "Apple Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:apple:mac_os_x_server",
      "@product": "Apple Mac OS X Server",
      "@vendor": "Apple Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:canonical:ubuntu_linux",
      "@product": "Ubuntu",
      "@vendor": "Canonical",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:fedoraproject:fedora",
      "@product": "Fedora",
      "@vendor": "Fedora Project",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:gentoo:linux_x11",
      "@product": "Gentoo Linux x11-base/xorg-server",
      "@vendor": "Gentoo Foundation, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:gentoo:linux_x11-libs",
      "@product": "Gentoo Linux x11-libs/libXfont",
      "@vendor": "Gentoo Foundation, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:hp:hp-ux",
      "@product": "HP-UX",
      "@vendor": "Hewlett-Packard Development Company,L.P",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:ibm:aix",
      "@product": "IBM AIX",
      "@vendor": "IBM Corporation",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:mandriva:linux-xfree86",
      "@product": "Mandriva Linux XFree86",
      "@vendor": "Mandriva, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:mandriva:linux-xorg",
      "@product": "Mandriva Linux xorg-x11",
      "@vendor": "Mandriva, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:misc:miraclelinux_asianux_server",
      "@product": "Asianux Server",
      "@vendor": "Cybertrust Japan Co., Ltd.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:openbsd:openbsd",
      "@product": "OpenBSD",
      "@vendor": "OpenBSD",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:opensuse_project:opensuse",
      "@product": "openSUSE",
      "@vendor": "openSUSE project",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:redhat:enterprise_linux",
      "@product": "Red Hat Enterprise Linux",
      "@vendor": "Red Hat, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:redhat:enterprise_linux_desktop",
      "@product": "Red Hat Enterprise Linux Desktop",
      "@vendor": "Red Hat, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:redhat:linux_advanced_workstation",
      "@product": "Red Hat Linux Advanced Workstation",
      "@vendor": "Red Hat, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:redhat:rhel_desktop_workstation",
      "@product": "RHEL Desktop Workstation",
      "@vendor": "Red Hat, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:sun:solaris",
      "@product": "Sun Solaris",
      "@vendor": "Sun Microsystems, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:linux_desktop",
      "@product": "Novell Linux Desktop",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:linux_enterprise_desktop",
      "@product": "SUSE Linux Enterprise Desktop",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:linux_enterprise_server",
      "@product": "SUSE Linux Enterprise Server",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:linux_pos",
      "@product": "Novell Linux POS",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:suse_linux",
      "@product": "SUSE LINUX",
      "@vendor": "SUSE",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:suse:suse_sle_sdk",
      "@product": "SLE SDK",
      "@vendor": "SUSE",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "7.4",
    "@severity": "High",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:S/C:C/I:C/A:C",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2008-001043",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN88935101/index.html",
      "@id": "JVN#88935101",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/en/tr/TRTA08-079A/index.html",
      "@id": "TRTA08-079A",
      "@source": "JVNTR"
    },
    {
      "#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0006",
      "@id": "CVE-2008-0006",
      "@source": "CVE"
    },
    {
      "#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-0006",
      "@id": "CVE-2008-0006",
      "@source": "NVD"
    },
    {
      "#text": "http://www.ipa.go.jp/security/english/vuln/200806_XOrg_press_en.html",
      "@id": "Security Alert for X.Org Foundation X Server Vulnerability",
      "@source": "IPA SECURITY ALERTS"
    },
    {
      "#text": "http://www.us-cert.gov/cas/alerts/SA08-079A.html",
      "@id": "SA08-079A",
      "@source": "CERT-SA"
    },
    {
      "#text": "http://www.kb.cert.org/vuls/id/203220",
      "@id": "VU#203220",
      "@source": "CERT-VN"
    },
    {
      "#text": "http://www.us-cert.gov/cas/techalerts/TA08-079A.html",
      "@id": "TA08-079A",
      "@source": "CERT-TA"
    },
    {
      "#text": "http://secunia.com/advisories/28532/",
      "@id": "SA28532",
      "@source": "SECUNIA"
    },
    {
      "#text": "http://www.securityfocus.com/bid/27352",
      "@id": "27352",
      "@source": "BID"
    },
    {
      "#text": "http://securitytracker.com/id?1019232",
      "@id": "1019232",
      "@source": "SECTRACK"
    },
    {
      "#text": "http://www.frsirt.com/english/advisories/2008/0179",
      "@id": "FrSIRT/ADV-2008-0179",
      "@source": "FRSIRT"
    },
    {
      "#text": "http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001043.html",
      "@id": "JVNDB-2008-001043",
      "@source": "JVNDB_Ja"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-119",
      "@title": "Buffer Errors(CWE-119)"
    }
  ],
  "title": "X.Org Foundation X server buffer overflow vulnerability"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.