CVE-2014-0211 — Improper Handling of Length Parameter Inconsistency in Libxfont

CWE-189CWE-130 — Improper Handling of Length Parameter InconsistencyCWE-787 — Out-of-bounds Write15 documents8 sources
Severity
7.5HIGHNVD
EPSS
2.4%
top 14.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
X.org LibxfontX LibxfontCanonical Ubuntu Linux
Timeline
PublishedMay 15
Latest updateMay 14

Description

Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages2 packages

▶Debianx.org/libxfont< 1:1.4.7-2+3
▶NVDx/libxfont1.4.7+20

Also affects: Ubuntu Linux 10.04, 12.04, 12.10, 13.10, 14.04

🔴Vulnerability Details

4
GHSA
GHSA-c656-hcc6-xc8v: Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X↗2022-05-14
▶
CVEList
CVE-2014-0211: Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X↗2014-05-15
▶
OSV
CVE-2014-0211: Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X↗2014-05-15
▶
OSV
libxfont vulnerabilities↗2014-05-14
▶

📋Vendor Advisories

3
Ubuntu
libXfont vulnerabilities↗2014-05-14
▶
Red Hat
libXfont: integer overflows calculating memory needs for xfs replies↗2014-05-13
▶
Debian
CVE-2014-0211: libxfont - Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3)...↗2014
▶

💬Community

7
Bugzilla
CVE-2014-0211 CVE-2014-0210 CVE-2014-0209 libXfont: various flaws [fedora-all]↗2014-05-13
▶
Bugzilla
CVE-2014-0211 libXfont: integer overflows calculating memory needs for xfs replies↗2014-05-12
▶
Bugzilla
CVE-2014-0061 postgresql: privilege escalation via procedural language validator functions↗2014-02-14
▶
Bugzilla
CVE-2014-0066 postgresql: NULL pointer dereference↗2014-02-14
▶
Bugzilla
CVE-2014-0064 postgresql: integer overflows leading to buffer overflows↗2014-02-14
▶