PT-2006-7608 · X.Org+2 · Libxfont+2

Published 1970-01-01 · Updated 2023-02-13 · CVE-2006-3467

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libXfont versions prior to 1.2.0 freetype2-64bit (affected versions not specified) freetype2-devel-64bit (affected versions not specified) freetype2-x86 (affected versions not specified) FreeType versions prior to 2.2

Description The issue is related to an integer overflow in FreeType, which can be exploited remotely. This may lead to a denial of service (crash) and potentially allow the execution of arbitrary code via a crafted PCF file. The vulnerability can compromise the confidentiality, integrity, and availability of protected information.

Recommendations For libXfont versions prior to 1.2.0, update to version 1.2.0 or later. For freetype2-64bit, freetype2-devel-64bit, and freetype2-x86, update to a version that includes the fix for the integer overflow issue. For FreeType versions prior to 2.2, update to version 2.2 or later. As a temporary workaround, consider restricting access to crafted PCF files to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-189

Related Identifiers

BDU:2015-04895

BDU:2015-04896

BDU:2015-04897

BDU:2015-09526

CVE-2006-3467

DSA-1178-1

DSA-1193-1

RHSA-2006:0500

RHSA-2006:0634

RHSA-2006:0635

RHSA-2006_0500

RHSA-2006_0634

Affected Products

Freetype

Red Hat

Libxfont

References · 75

• http://secunia.com/advisories/21836 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-3467 · Vendor Advisory
• http://secunia.com/advisories/21567 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-3467 · Security Note
• http://secunia.com/advisories/22907 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2006:148 · Vendor Advisory
• http://secunia.com/advisories/27271 · Vendor Advisory
• http://secunia.com/advisories/21793 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2006-0500.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06175 · Security Note
• http://debian.org/security/2006/dsa-1193 · Vendor Advisory
• ftp://patches.sgi.com/support/free/security/advisories/20060701-01-U · Vendor Advisory
• http://trustix.org/errata/2006/0052 · Vendor Advisory
• http://secunia.com/advisories/21285 · Vendor Advisory
• http://secunia.com/advisories/23939 · Vendor Advisory