Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.

Updated libxfont packages fix security vulnerabilities :

Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges (CVE-2014-0209).

Ilja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially crafted data that could cause libXfont to crash, or possibly execute arbitrary code (CVE-2014-0210, CVE-2014-0211).

The bdf parser reads a count for the number of properties defined in a font from the font file, and allocates arrays with entries for each property based on that count. It never checked to see if that count was negative, or large enough to overflow when multiplied by the size of the structures being allocated, and could thus allocate the wrong buffer size, leading to out of bounds writes (CVE-2015-1802).

If the bdf parser failed to parse the data for the bitmap for any character, it would proceed with an invalid pointer to the bitmap data and later crash when trying to read the bitmap from that pointer (CVE-2015-1803).

The bdf parser read metrics values as 32-bit integers, but stored them into 16-bit integers. Overflows could occur in various operations leading to out-of-bounds memory access (CVE-2015-1804).

The remote host is affected by the vulnerability described in GLSA-201406-11 (libXfont: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libXfont. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could use a specially crafted file to gain       privileges, cause a Denial of Service condition or possibly execute       arbitrary code with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

The remote Solaris system is missing necessary patches to address security updates :

  - Multiple integer overflows in the (1) FontFileAddEntry     and (2) lexAlias functions in X.Org libXfont before     1.4.8 and 1.4.9x before 1.4.99.901 might allow local     users to gain privileges by adding a directory with a     large fonts.dir or fonts.alias file to the font path,     which triggers a heap-based buffer overflow, related to     metadata. (CVE-2014-0209)

  - Multiple buffer overflows in X.Org libXfont before 1.4.8     and 1.4.9x before 1.4.99.901 allow remote font servers     to execute arbitrary code via a crafted xfs protocol     reply to the (1) _fs_recv_conn_setup, (2)     fs_read_open_font, (3) fs_read_query_info, (4)     fs_read_extent_info, (5) fs_read_glyphs, (6)     fs_read_list, or (7) fs_read_list_info function.
    (CVE-2014-0210)

  - Multiple integer overflows in the (1) fs_get_reply, (2)     fs_alloc_glyphs, and (3) fs_read_extent_info functions     in X.Org libXfont before 1.4.8 and 1.4.9x before     1.4.99.901 allow remote font servers to execute     arbitrary code via a crafted xfs reply, which triggers a     buffer overflow. (CVE-2014-0211)

Updated libXfont packages that fix three security issues are now available for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libXfont packages provide the X.Org libXfont runtime library.
X.Org is an open source implementation of the X Window System.

A use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.
(CVE-2014-0209)

Multiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server.
(CVE-2014-0210, CVE-2014-0211)

Red Hat would like to thank the X.org project for reporting these issues. Upstream acknowledges Ilja van Sprundel as the original reporter.

Users of libXfont should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running X.Org server instances must be restarted for the update to take effect.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2014-0209: integer overflow of allocations in font     metadata file parsing (bug 1163602, bug 1163601)

  - CVE-2014-0210: unvalidated length fields when parsing     xfs protocol replies (bug 1163602, bug 1163601)

  - CVE-2014-0211: integer overflows calculating memory     needs for xfs replies (bug 1163602, bug 1163601)

  - CVE-2013-6462.patch: sscanf overflow (bug 1049684)

  - sscanf-hardening.patch: Some other sscanf hardening     fixes (1049684)

A use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.
(CVE-2014-0209)

Multiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server.
(CVE-2014-0210, CVE-2014-0211)

All running X.Org server instances must be restarted for the update to take effect.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1893 advisory.

    - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601)
    - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2014:1870 :

Updated libXfont packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libXfont packages provide the X.Org libXfont runtime library.
X.Org is an open source implementation of the X Window System.

A use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.
(CVE-2014-0209)

Multiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server.
(CVE-2014-0210, CVE-2014-0211)

Red Hat would like to thank the X.org project for reporting these issues. Upstream acknowledges Ilja van Sprundel as the original reporter.

Users of libXfont should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running X.Org server instances must be restarted for the update to take effect.

Updated libXfont packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libXfont packages provide the X.Org libXfont runtime library.
X.Org is an open source implementation of the X Window System.

A use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.
(CVE-2014-0209)

Multiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server.
(CVE-2014-0210, CVE-2014-0211)

Red Hat would like to thank the X.org project for reporting these issues. Upstream acknowledges Ilja van Sprundel as the original reporter.

Users of libXfont should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running X.Org server instances must be restarted for the update to take effect.

Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.

Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.

Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.

- libXfont 1.4.8 (rhbz#1100441)

    - Fixes: CVE-2014-0209, CVE-2014-0210, CVE-2014-0211       (rhbz#1097397)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host has a version of Oracle Secure Global Desktop that is version 4.63, 4.71, 5.0 or 5.1. It is, therefore, affected by the following vulnerabilities :

  - Apache Tomcat does not properly handle certain     inconsistent HTTP request headers, which allows remote     attackers to trigger incorrect identification of a     request's length and conduct request-smuggling attacks.
    (CVE-2013-4286)

  - CoyoteAdapter.java in Apache Tomcat does not consider     the 'disableURLRewriting' setting when handling session     ID in a URL, allowing a remote attacker to conduct     session fixation attacks via a crafted URL.
    (CVE-2014-0033)

  - The 'log_cookie' function in mod_log_config.c of Apache     will not handle specially crafted cookies during     truncation, allowing a remote attacker to cause a denial     of service via a segmentation fault. (CVE-2014-0098)

  - Multiple integer overflows within X.Org libXfont that     could allow remote font servers to execute arbitrary     code via a crafted xfs reply, which triggers a buffer     overflow. (CVE-2014-0211)

  - OpenSSL does not properly restrict processing of     'ChangeCipherSpec' messages which allows     man-in-the-middle attackers to trigger use of a     zero-length master key and consequently hijack sessions     or obtain sensitive information via a crafted TLS     handshake. (CVE-2014-0224)

  - An unspecified flaw related to the Workspace Web     Application subcomponent could allow a remote attacker     to impact integrity. (CVE-2014-4232)

Updated libxfont packages fix security vulnerabilities :

Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges (CVE-2014-0209).

Ilja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially crafted data that could cause libXfont to crash, or possibly execute arbitrary code (CVE-2014-0210, CVE-2014-0211).

libxfont was updated to fix multiple vulnerabilities :

  - Integer overflow of allocations in font metadata file     parsing (CVE-2014-0209).

  - Unvalidated length fields when parsing xfs protocol     replies (CVE-2014-0210).

  - Integer overflows calculating memory needs for xfs     replies (CVE-2014-0211).

These vulnerabilities could be used by a local, authenticated user to raise privileges or by a remote attacker with control of the font server to execute code with the privileges of the X server.

xorg-x11-libs was patched to fix the following security issues :

  - Integer overflow of allocations in font metadata file     parsing. (CVE-2014-0209)

  - libxfont not validating length fields when parsing xfs     protocol replies. (CVE-2014-0210)

  - Integer overflows causing miscalculating memory needs     for xfs replies. (CVE-2014-0211) Further information is     available at     http://lists.x.org/archives/xorg-announce/2014-May/00243     1.html .

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2211-1 advisory.

    Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local     attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to     gain privileges. (CVE-2014-0209)

    Ilja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font     server could return specially-crafted data that could cause libXfont to crash, or possibly execute     arbitrary code. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu     13.10. (CVE-2014-0210, CVE-2014-0211)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Alan Coopersmith reports :

Ilja van Sprundel, a security researcher with IOActive, has discovered several issues in the way the libXfont library handles the responses it receives from xfs servers, and has worked with X.Org's security team to analyze, confirm, and fix these issues.

Most of these issues stem from libXfont trusting the font server to send valid protocol data, and not verifying that the values will not overflow or cause other damage. This code is commonly called from the X server when an X Font Server is active in the font path, so may be running in a setuid-root process depending on the X server in use.
Exploits of this path could be used by a local, authenticated user to attempt to raise privileges; or by a remote attacker who can control the font server to attempt to execute code with the privileges of the X server.

Ilja van Sprundel of IOActive discovered several security issues in the X.Org libXfont library, which may allow a local, authenticated user to attempt to raise privileges; or a remote attacker who can control the font server to attempt to execute code with the privileges of the X server.

  - CVE-2014-0209     Integer overflow of allocations in font metadata file     parsing could allow a local user who is already     authenticated to the X server to overwrite other memory     in the heap.

  - CVE-2014-0210     libxfont does not validate length fields when parsing     xfs protocol replies allowing to write past the bounds     of allocated memory when storing the returned data from     the font server.

  - CVE-2014-0211     Integer overflows calculating memory needs for xfs     replies could result in allocating too little memory and     then writing the returned data from the font server past     the end of the allocated buffer.

ID	Name	Product	Family	Severity
82398	Mandriva Linux Security Advisory : libxfont (MDVSA-2015:145-1)	Nessus	Mandriva Local Security Checks	high
82003	GLSA-201406-11 : libXfont: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
80823	Oracle Solaris Third-Party Patch Update : xorg (multiple_vulnerabilities_in_x_org2)	Nessus	Solaris Local Security Checks	high
79563	CentOS 5 : libXfont (CESA-2014:1893)	Nessus	CentOS Local Security Checks	high
79557	OracleVM 3.3 : libXfont (OVMSA-2014-0080)	Nessus	OracleVM Local Security Checks	high
79427	Scientific Linux Security Update : libXfont on SL5.x i386/x86_64 (20141124)	Nessus	Scientific Linux Local Security Checks	high
79425	RHEL 5 : libXfont (RHSA-2014:1893)	Nessus	Red Hat Local Security Checks	high
79424	Oracle Linux 5 : libXfont (ELSA-2014-1893)	Nessus	Oracle Linux Local Security Checks	critical
79371	Oracle Linux 6 / 7 : libXfont (ELSA-2014-1870)	Nessus	Oracle Linux Local Security Checks	high
79330	Scientific Linux Security Update : libXfont on SL6.x, SL7.x i386/srpm/x86_64 (20141118)	Nessus	Scientific Linux Local Security Checks	high
79327	RHEL 6 / 7 : libXfont (RHSA-2014:1870)	Nessus	Red Hat Local Security Checks	high
79313	CentOS 6 / 7 : libXfont (CESA-2014:1870)	Nessus	CentOS Local Security Checks	high
78347	Amazon Linux AMI : libXfont (ALAS-2014-404)	Nessus	Amazon Linux Local Security Checks	high
76693	Fedora 19 : libXfont-1.4.8-1.fc19 (2014-8223)	Nessus	Fedora Local Security Checks	high
76570	Oracle Secure Global Desktop Multiple Vulnerabilities (July 2014 CPU)	Nessus	Misc.	high
76514	Fedora 20 : libXfont-1.4.8-1.fc20 (2014-8208)	Nessus	Fedora Local Security Checks	high
76440	Mandriva Linux Security Advisory : libxfont (MDVSA-2014:132)	Nessus	Mandriva Local Security Checks	high
75371	openSUSE Security Update : libXfont (openSUSE-SU-2014:0711-1)	Nessus	SuSE Local Security Checks	high
74463	SuSE 11.3 Security Update : xorg-x11-libs (SAT Patch Number 9272)	Nessus	SuSE Local Security Checks	high
74022	Ubuntu 14.04 LTS : libXfont vulnerabilities (USN-2211-1)	Nessus	Ubuntu Local Security Checks	critical
74004	FreeBSD : libXfont -- X Font Service Protocol and Font metadata file handling issues (b060ee50-daba-11e3-99f2-bcaec565249c)	Nessus	FreeBSD Local Security Checks	high
73997	Debian DSA-2927-1 : libxfont - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2014-0211

critical

Tenable Plugins

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

high

high

high

critical

high

high