The bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont before 1.4.9 and 1.5.x before 1.5.1 does not properly handle character bitmaps it cannot read, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) and possibly execute arbitrary code via a crafted BDF font file.

An updated libXfont package that fixes three security issues is now available for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

The libXfont package provides the X.Org libXfont runtime library.
X.Org is an open source implementation of the X Window System.

An integer overflow flaw was found in the way libXfont processed certain Glyph Bitmap Distribution Format (BDF) fonts. A malicious, local user could use this flaw to crash the X.Org server or, potentially, execute arbitrary code with the privileges of the X.Org server. (CVE-2015-1802)

An integer truncation flaw was discovered in the way libXfont processed certain Glyph Bitmap Distribution Format (BDF) fonts. A malicious, local user could use this flaw to crash the X.Org server or, potentially, execute arbitrary code with the privileges of the X.Org server. (CVE-2015-1804)

A NULL pointer dereference flaw was discovered in the way libXfont processed certain Glyph Bitmap Distribution Format (BDF) fonts. A malicious, local user could use this flaw to crash the X.Org server.
(CVE-2015-1803)

All libXfont users are advised to upgrade to this updated package, which contains backported patches to correct these issues.

An integer overflow flaw was found in the way libXfont processed certain Glyph Bitmap Distribution Format (BDF) fonts. A malicious, local user could use this flaw to crash the X.Org server or, potentially, execute arbitrary code with the privileges of the X.Org server. (CVE-2015-1802)

An integer truncation flaw was discovered in the way libXfont processed certain Glyph Bitmap Distribution Format (BDF) fonts. A malicious, local user could use this flaw to crash the X.Org server or, potentially, execute arbitrary code with the privileges of the X.Org server. (CVE-2015-1804)

A NULL pointer dereference flaw was discovered in the way libXfont processed certain Glyph Bitmap Distribution Format (BDF) fonts. A malicious, local user could use this flaw to crash the X.Org server.
(CVE-2015-1803)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - CVE-2015-1802: missing range check in bdfReadProperties     (bug 1258892)

  - CVE-2015-1803: crash on invalid read in     bdfReadCharacters (bug 1258892)

  - CVE-2015-1804: out-of-bounds memory access in     bdfReadCharacters (bug 1258892)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1708 advisory.

    - CVE-2015-1802: missing range check in bdfReadProperties (bug 1258892)
    - CVE-2015-1803: crash on invalid read in bdfReadCharacters (bug 1258892)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201507-21 (libXfont: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libXfont. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code or cause a       Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The Oracle Secure Global Desktop installed on the remote host is version 4.63 / 4.71 / 5.1 / 5.2. It is, therefore, affected by the following vulnerabilities :

  - A security bypass vulnerability exists in Kerberos 5 due     to a failure to properly determine the acceptability of     checksums. A remote attacker can exploit this to forge     tokens or gain privileges by using an unkeyed checksum.
    (CVE-2010-1324)

  - A NULL pointer deference flaw exists in the function     bdfReadCharacters() in file bdfread.c of the X.Org     libXfont module due to improper handling of non-readable     character bitmaps. An authenticated, remote attacker,     using a crafted BDF font file, can exploit this to     cause a denial of service or execute arbitrary code.
    (CVE-2015-1803)

  - An out-of-bounds read/write error exists in the     SProcXFixesSelectSelectionInput() function in the     XFixes extension. A remote, authenticated attacker,     using a crafted length value, can exploit this to     cause a denial of service or execute arbitrary code.
    (CVE-2014-8102)

  - A remote attacker, by using a crafted string length     value in an XkbSetGeometry request, can gain access to     sensitive information from process memory or cause a     denial of service. (CVE-2015-0255)

  - An invalid read error exists in the ASN1_TYPE_cmp()     function due to improperly performed boolean-type     comparisons. A remote attacker can exploit this, via a     crafted X.509 certificate to an endpoint that uses the     certificate-verification feature, to cause an invalid     read operation, resulting in a denial of service.
    (CVE-2015-0286)

  - A denial of service vulnerability exists in Apache     Tomcat due to improper handling of HTTP responses     that occurs before finishing reading an entire request     body. A remote attacker can exploit this by using a     crafted series of aborted upload attempts.
    (CVE-2014-0230)

  - A denial of service vulnerability exists in Apache     Tomcat in ChunkedInputFilter.java due to improper     handling of attempts to read data after an error has     occurred. A remote attacker can exploit this by     streaming data with malformed chunked-transfer     encoding. (CVE-2014-0227)

  - A NULL pointer dereference flaw exists in the     dtls1_get_record() function when handling DTLS messages.
    A remote attacker, using a specially crafted DTLS     message, can cause a denial of service. (CVE-2014-3571)

  - An unspecified flaw exists that is related to the     JServer subcomponent. A remote attacker can exploit this     to impact confidentiality and integrity. No further     details have been provided. (CVE-2015-2581)

LibXFont was updated to fix security problems that could be used by local attackers to gain X server privileges (root).

The following security issues have been fixed :

  - The bdf parser reads a count for the number of     properties defined in a font from the font file, and     allocates arrays with entries for each property based on     that count. It never checked to see if that count was     negative, or large enough to overflow when multiplied by     the size of the structures being allocated, and could     thus allocate the wrong buffer size, leading to out of     bounds writes. (CVE-2015-1802)

  - If the bdf parser failed to parse the data for the     bitmap for any character, it would proceed with an     invalid pointer to the bitmap data and later crash when     trying to read the bitmap from that pointer.
    (CVE-2015-1803)

  - The bdf parser read metrics values as 32-bit integers,     but stored them into 16-bit integers. Overflows could     occur in various operations leading to out-of-bounds     memory access. (CVE-2015-1804)

libXFont was updated to fix three vulnerabilities when parsing BDF files (bnc#921978)

As libXfont is used by the X server to read font files, and an unprivileged user with access to the X server can tell the X server to read a given font file from a path of their choosing, these vulnerabilities have the potential to allow unprivileged users to run code with the privileges of the X server.

The following vulnerabilities were fixed :

  - The BDF parser could allocate the a wrong buffer size,     leading to out of bound writes (CVE-2015-1802)

  - The BDF parser could crash when trying to read an     invalid pointer (CVE-2015-1803)

  - The BDF parser could read 32 bit metrics values into 16     bit integers, causing an out-of-bound memory access     though integer overflow (CVE-2015-1804)

Updated libxfont packages fix security vulnerabilities :

Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges (CVE-2014-0209).

Ilja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially crafted data that could cause libXfont to crash, or possibly execute arbitrary code (CVE-2014-0210, CVE-2014-0211).

The bdf parser reads a count for the number of properties defined in a font from the font file, and allocates arrays with entries for each property based on that count. It never checked to see if that count was negative, or large enough to overflow when multiplied by the size of the structures being allocated, and could thus allocate the wrong buffer size, leading to out of bounds writes (CVE-2015-1802).

If the bdf parser failed to parse the data for the bitmap for any character, it would proceed with an invalid pointer to the bitmap data and later crash when trying to read the bitmap from that pointer (CVE-2015-1803).

The bdf parser read metrics values as 32-bit integers, but stored them into 16-bit integers. Overflows could occur in various operations leading to out-of-bounds memory access (CVE-2015-1804).

Ilja van Sprundel, Alan Coopersmith and William Robinet discovered multiple issues in libxfont's code to process BDF fonts, which might result in privilege escalation.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-1802, CVE-2015-1803, CVE-2015-1804

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libXfont 1.5.1 (CVE-2015-1802, CVE-2015-1803, CVE-2015-1804)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2536-1 advisory.

    Ilja van Sprundel, Alan Coopersmith, and William Robinet discovered that libXfont incorrectly handled     malformed bdf fonts. A local attacker could use this issue to cause libXfont to crash, or possibly execute     arbitrary code in order to gain privileges.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Alan Coopersmith reports :

Ilja van Sprundel, a security researcher with IOActive, has discovered an issue in the parsing of BDF font files by libXfont. Additional testing by Alan Coopersmith and William Robinet with the American Fuzzy Lop (afl) tool uncovered two more issues in the parsing of BDF font files.

As libXfont is used by the X server to read font files, and an unprivileged user with access to the X server can tell the X server to read a given font file from a path of their choosing, these vulnerabilities have the potential to allow unprivileged users to run code with the privileges of the X server (often root access).

Ilja van Sprundel, Alan Coopersmith and William Robinet discovered multiple issues in libxfont's code to process BDF fonts, which might result in privilege escalation.

ID	Name	Product	Family	Severity
86506	CentOS 6 / 7 : libXfont (CESA-2015:1708)	Nessus	CentOS Local Security Checks	high
86075	Amazon Linux AMI : libXfont (ALAS-2015-597)	Nessus	Amazon Linux Local Security Checks	high
85973	RHEL 6 / 7 : libXfont (RHSA-2015:1708)	Nessus	Red Hat Local Security Checks	high
85788	Scientific Linux Security Update : libXfont on SL6.x, SL7.x i386/x86_64 (20150903)	Nessus	Scientific Linux Local Security Checks	high
85784	OracleVM 3.3 : libXfont (OVMSA-2015-0120)	Nessus	OracleVM Local Security Checks	high
85780	Oracle Linux 6 / 7 : libXfont (ELSA-2015-1708)	Nessus	Oracle Linux Local Security Checks	critical
84935	GLSA-201507-21 : libXfont: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
84795	Oracle Secure Global Desktop Multiple Vulnerabilities (July 2015 CPU)	Nessus	Misc.	high
82641	SuSE 11.3 Security Update : xorg-x11-libs (SAT Patch Number 10487)	Nessus	SuSE Local Security Checks	high
82424	openSUSE Security Update : libXfont (openSUSE-2015-266)	Nessus	SuSE Local Security Checks	high
82398	Mandriva Linux Security Advisory : libxfont (MDVSA-2015:145-1)	Nessus	Mandriva Local Security Checks	high
82300	Debian DLA-183-1 : libxfont security update	Nessus	Debian Local Security Checks	high
82057	Fedora 21 : libXfont-1.5.1-1.fc21 (2015-4230)	Nessus	Fedora Local Security Checks	high
81994	Fedora 22 : libXfont-1.5.1-1.fc22 (2015-4199)	Nessus	Fedora Local Security Checks	high
81951	Ubuntu 14.04 LTS : libXfont vulnerabilities (USN-2536-1)	Nessus	Ubuntu Local Security Checks	critical
81901	FreeBSD : libXfont -- BDF parsing issues (f7d79fac-cd49-11e4-898f-bcaec565249c)	Nessus	FreeBSD Local Security Checks	high
81900	Debian DSA-3194-1 : libxfont - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-1803

critical

Tenable Plugins

high

high

high

high

high

critical

high

high

high

high

high

high

high

high

critical

high

high