CVE-2014-0209
libXfont: integer overflow of allocations in font metadata file parsing
Severity Score
4.6
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.
Múltiples desbordamientos de enteros en las funciones (1) FontFileAddEntry y (2) lexAlias en X.Org libXfont anterior a 1.4.8 y 1.4.9x anterior a 1.4.99.901 podrían permitir a usuarios locales ganar privilegios mediante la adición de un directorio con un archivo fonts.dir o fonts.alias largo a la ruta de la fuente, lo que provoca un desbordamiento de buffer basado en memoria dinámica, relacionado con metadatos.
A use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2013-12-03 CVE Reserved
- 2014-05-14 CVE Published
- 2024-02-09 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-189: Numeric Errors
- CWE-190: Integer Overflow or Wraparound
CAPEC
References (15)
| URL | Tag | Source |
|---|---|---|
| http://advisories.mageia.org/MGASA-2014-0278.html | X_refsource_confirm | |
| http://seclists.org/fulldisclosure/2014/Dec/23 | Mailing List |
|
| http://secunia.com/advisories/59154 | Third Party Advisory | |
| http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html | X_refsource_confirm |
|
| http://www.securityfocus.com/archive/1/534161/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/bid/67382 | Vdb Entry | |
| http://www.vmware.com/security/advisories/VMSA-2014-0012.html | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-updates/2014-05/msg00073.html | 2018-10-09 | |
| http://lists.x.org/archives/xorg-announce/2014-May/002431.html | 2018-10-09 | |
| http://rhn.redhat.com/errata/RHSA-2014-1893.html | 2018-10-09 | |
| http://www.debian.org/security/2014/dsa-2927 | 2018-10-09 | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2015:145 | 2018-10-09 | |
| http://www.ubuntu.com/usn/USN-2211-1 | 2018-10-09 | |
| https://access.redhat.com/security/cve/CVE-2014-0209 | 2014-11-24 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1096593 | 2014-11-24 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | <= 1.4.7 Search vendor "X" for product "Libxfont" and version " <= 1.4.7" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.2.3 Search vendor "X" for product "Libxfont" and version "1.2.3" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.2.4 Search vendor "X" for product "Libxfont" and version "1.2.4" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.2.5 Search vendor "X" for product "Libxfont" and version "1.2.5" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.2.6 Search vendor "X" for product "Libxfont" and version "1.2.6" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.2.7 Search vendor "X" for product "Libxfont" and version "1.2.7" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.2.8 Search vendor "X" for product "Libxfont" and version "1.2.8" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.2.9 Search vendor "X" for product "Libxfont" and version "1.2.9" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.3.0 Search vendor "X" for product "Libxfont" and version "1.3.0" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.3.1 Search vendor "X" for product "Libxfont" and version "1.3.1" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.3.2 Search vendor "X" for product "Libxfont" and version "1.3.2" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.3.3 Search vendor "X" for product "Libxfont" and version "1.3.3" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.3.4 Search vendor "X" for product "Libxfont" and version "1.3.4" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.4.0 Search vendor "X" for product "Libxfont" and version "1.4.0" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.4.1 Search vendor "X" for product "Libxfont" and version "1.4.1" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.4.2 Search vendor "X" for product "Libxfont" and version "1.4.2" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.4.3 Search vendor "X" for product "Libxfont" and version "1.4.3" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.4.4 Search vendor "X" for product "Libxfont" and version "1.4.4" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.4.5 Search vendor "X" for product "Libxfont" and version "1.4.5" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.4.6 Search vendor "X" for product "Libxfont" and version "1.4.6" | - |
Affected
| ||||||
| X Search vendor "X" | Libxfont Search vendor "X" for product "Libxfont" | 1.4.99 Search vendor "X" for product "Libxfont" and version "1.4.99" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 10.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "10.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 13.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "13.10" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||