PT-2017-13043 · X.Org Foundation+3 · Libxfont+3

Published 2017-10-05 · Updated 2024-06-15 · CVE-2017-13722

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libXfont versions prior to 1.5.2 and 2.x before 2.0.2

Description A missing boundary check in the pcfGetProperties function in bitmap/pcfread.c could allow local attackers authenticated to an X server to perform a buffer over-read. This could lead to information disclosure or cause the X server to crash.

Recommendations For libXfont versions prior to 1.5.2, update to version 1.5.2 or later. For libXfont 2.x versions before 2.0.2, update to version 2.0.2 or later. As a temporary workaround, consider restricting access to the pcfGetProperties function in bitmap/pcfread.c until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2017-2478

ALT-PU-2017-2480

CVE-2017-13722

DLA-1126-1

DSA-3995-1

MGASA-2017-0373

OPENSUSE-SU-2024:10921-1

SUSE-SU-2018:0246-1

SUSE-SU-2018:0334-1

USN-3442-1

Affected Products

Alt Linux

Suse

Ubuntu

Libxfont

References · 43

• https://osv.dev/vulnerability/DSA-3995-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13720 · Security Note
• https://osv.dev/vulnerability/CVE-2017-13722 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-13722 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0373.html · Security Note
• https://ubuntu.com/security/CVE-2017-13722 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-13720 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/libxfont · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3442-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:0334-1 · Vendor Advisory
• https://debian.org/security/2017/dsa-3995 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3442-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-13722 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10921-1 · Vendor Advisory
• https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=672bb944311392e2415b39c0d63b1e1902905bcd · Patch