CVE-2008-0006 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Xserver

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer12 documents9 sources
Severity
7.5HIGHNVD
EPSS
29.3%
top 3.40%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
X.org LibxfontX.org Xorg-serverX.org Xserver
Timeline
PublishedJan 18
Latest updateMay 1

Description

Buffer overflow in (1) X.Org Xserver before 1.4.1, and (2) the libfont and libXfont libraries on some platforms including Sun Solaris, allows context-dependent attackers to execute arbitrary code via a PCF font with a large difference between the last col and first col values in the PCF_BDF_ENCODINGS table.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶Debianx.org/libxfont< 1:1.3.1-2+3
▶NVDx.org/xserver1.4
▶Debianx.org/xorg-server< 2:1.4.1~git20080105-2+3

Patches

Patch: lists.freedesktop.org ↗Patch: sunsolve.sun.com ↗Patch: www.securityfocus.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-8jcc-7w3m-qv8c: Buffer overflow in (1) X↗2022-05-01
▶
CVEList
CVE-2008-0006: Buffer overflow in (1) X↗2008-01-18
▶
OSV
CVE-2008-0006: Buffer overflow in (1) X↗2008-01-18
▶

💥Exploits & PoCs

1
Exploit-DB
S.T.A.L.K.E.R Shadow of Chernobyl 1.0006 - Multiple Remote Vulnerabilities↗2008-06-28
▶

📋Vendor Advisories

3
Ubuntu
X.org vulnerabilities↗2008-01-18
▶
Red Hat
Xorg / XFree86 PCF font parser buffer overflow↗2008-01-17
▶
Debian
CVE-2008-0006: libxfont - Buffer overflow in (1) X.Org Xserver before 1.4.1, and (2) the libfont and libXf...↗2008
▶

💬Community

4
Bugzilla
nx: Appears to embed a vulnerable version of libXfont prone to CVE-2008-0006↗2010-12-03
▶
Bugzilla
CVE-2008-2368 Certificate System: plain text passwords stored in debug log↗2008-06-18
▶
Bugzilla
CVE-2008-2367 Certificate System: insecure config file permissions↗2008-06-18
▶
Bugzilla
CVE-2008-0006 Xorg / XFree86 PCF font parser buffer overflow↗2008-01-08
▶