PT-2017-4221 · X.Org Foundation+2 · Libxfont+3

Johannes Segitz · Published 2017-11-06 · Updated 2024-06-15 · CVE-2017-16611

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libXfont versions prior to 1.5.4 libXfont2 versions prior to 2.0.3

Description The issue is related to incorrect handling of symbolic links before accessing a file, allowing a local attacker to open files on the system as root. This can trigger mechanisms such as tape rewinds or watchdogs. The exploitation of this issue can lead to a denial of service.

Recommendations For libXfont versions prior to 1.5.4, update to version 1.5.4 or later. For libXfont2 versions prior to 2.0.3, update to version 2.0.3 or later.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

ALT-PU-2017-2728

ALT-PU-2017-2729

BDU:2022-06035

CVE-2017-16611

DLA-2901-1

MGASA-2017-0442

OPENSUSE-SU-2024:10921-1

OPENSUSE-SU-2024:10922-1

USN-3500-1

Affected Products

Alt Linux

Ubuntu

Libxfont

Libxfont2

References · 43

• https://nvd.nist.gov/vuln/detail/CVE-2017-16611 · Security Note
• https://security-tracker.debian.org/tracker/source-package/libxfont · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16611 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16611 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-16611 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-2728 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10921-1 · Vendor Advisory
• https://marc.info/?l=freedesktop-xorg-announce&m=151188044218304&w=2 · Patch
• http://openwall.com/lists/oss-security/2017/11/28/7 · Patch
• http://ubuntu.com/usn/USN-3500-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2901-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16611 · Security Note
• https://bdu.fstec.ru/vul/2022-06035 · Security Note
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20220829SE16 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-16611 · Vendor Advisory