Executive Summary
Summary | |
---|---|
Title | libXfont: Multiple vulnerabilities |
Informations | |||
---|---|---|---|
Name | GLSA-201406-11 | First vendor Publication | 2014-06-14 |
Vendor | Gentoo | Last vendor Modification | 2014-06-14 |
Severity (Vendor) | High | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 7.5 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Synopsis Multiple vulnerabilities have been found in libXfont, the worst of which allow for local privilege escalation. Background Description Impact Workaround Resolution References Availability http://security.gentoo.org/glsa/glsa-201406-11.xml |
Original Source
Url : http://security.gentoo.org/glsa/glsa-201406-11.xml |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
67 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
33 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:24797 | |||
Oval ID: | oval:org.mitre.oval:def:24797 | ||
Title: | USN-2211-1 -- libxfont vulnerabilities | ||
Description: | Several security issues were fixed in libXfont. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-2211-1 CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 | Version: | 5 |
Platform(s): | Ubuntu 14.04 Ubuntu 13.10 Ubuntu 12.10 Ubuntu 12.04 Ubuntu 10.04 | Product(s): | libxfont |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:24874 | |||
Oval ID: | oval:org.mitre.oval:def:24874 | ||
Title: | DSA-2927-1 libxfont - security update | ||
Description: | Ilja van Sprundel of IOActive discovered several security issues in theX.Org libXfont library, which may allow a local, authenticated user to attempt to raise privileges; or a remote attacker who can control the font server to attempt to execute code with the privileges of the X server. | ||
Family: | unix | Class: | patch |
Reference(s): | DSA-2927-1 CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 | Version: | 5 |
Platform(s): | Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7 | Product(s): | libxfont |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:25303 | |||
Oval ID: | oval:org.mitre.oval:def:25303 | ||
Title: | SUSE-SU-2014:0774-1 -- Security update for xorg-x11-libs | ||
Description: | xorg-x11-libs was patched to fix the following security issues: * Integer overflow of allocations in font metadata file parsing. (CVE-2014-0209) * libxfont not validating length fields when parsing xfs protocol replies. (CVE-2014-0210) * Integer overflows causing miscalculating memory needs for xfs replies. (CVE-2014-0211) | ||
Family: | unix | Class: | patch |
Reference(s): | SUSE-SU-2014:0774-1 CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 | Version: | 3 |
Platform(s): | SUSE Linux Enterprise Server 11 SUSE Linux Enterprise Desktop 11 | Product(s): | xorg-x11-libs |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:25958 | |||
Oval ID: | oval:org.mitre.oval:def:25958 | ||
Title: | SUSE-SU-2014:0881-1 -- Security update for xorg-x11-libs | ||
Description: | This is a SUSE Linux Enterprise Server 11 SP1 LTSS roll up update of xorg-x11-libs, fixing security issues and some bugs. | ||
Family: | unix | Class: | patch |
Reference(s): | SUSE-SU-2014:0881-1 CVE-2013-1984 CVE-2013-1985 CVE-2013-1986 CVE-2013-1988 CVE-2013-1990 CVE-2013-1991 CVE-2013-1992 CVE-2013-1995 CVE-2013-1996 CVE-2013-1998 CVE-2013-1999 CVE-2013-2000 CVE-2013-2001 CVE-2013-2003 CVE-2013-2063 CVE-2013-6462 CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 | Version: | 3 |
Platform(s): | SUSE Linux Enterprise Server 11 | Product(s): | xorg-x11-libs |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27716 | |||
Oval ID: | oval:org.mitre.oval:def:27716 | ||
Title: | RHSA-2014:1893 -- libXfont security update (Important) | ||
Description: | The libXfont packages provide the X.Org libXfont runtime library. X.Org is an open source implementation of the X Window System. A use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server. (CVE-2014-0209) Multiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server. (CVE-2014-0210, CVE-2014-0211) Red Hat would like to thank the X.org project for reporting these issues. Upstream acknowledges Ilja van Sprundel as the original reporter. Users of libXfont should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running X.Org server instances must be restarted for the update to take effect. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2014:1893 CESA-2014:1893 CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | libXfont |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:28393 | |||
Oval ID: | oval:org.mitre.oval:def:28393 | ||
Title: | ELSA-2014-1870 -- libXfont security update (important) | ||
Description: | [1.4.5-4] - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601) - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601) - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601) | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-1870 CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 | Version: | 3 |
Platform(s): | Oracle Linux 6 Oracle Linux 7 | Product(s): | libXfont |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:28414 | |||
Oval ID: | oval:org.mitre.oval:def:28414 | ||
Title: | ELSA-2014-1893 -- libXfont security update (important) | ||
Description: | [1.2.2-1.0.6] - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601) - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601) - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601) | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2014-1893 CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 | Version: | 3 |
Platform(s): | Oracle Linux 5 | Product(s): | libXfont |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:28435 | |||
Oval ID: | oval:org.mitre.oval:def:28435 | ||
Title: | RHSA-2014:1870 -- libXfont security update (Important) | ||
Description: | The libXfont packages provide the X.Org libXfont runtime library. X.Org is an open source implementation of the X Window System. A use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server. (CVE-2014-0209) Multiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server. (CVE-2014-0210, CVE-2014-0211) Red Hat would like to thank the X.org project for reporting these issues. Upstream acknowledges Ilja van Sprundel as the original reporter. Users of libXfont should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running X.Org server instances must be restarted for the update to take effect. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2014:1870 CESA-2014:1870-CentOS 6 CESA-2014:1870-CentOS 7 CVE-2014-0209 CVE-2014-0210 CVE-2014-0211 | Version: | 3 |
Platform(s): | Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 CentOS Linux 6 CentOS Linux 7 | Product(s): | libXfont |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2015-03-30 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2015-145.nasl - Type : ACT_GATHER_INFO |
2015-03-27 | Name : The remote Fedora host is missing a security update. File : fedora_2015-3964.nasl - Type : ACT_GATHER_INFO |
2015-03-27 | Name : The remote Fedora host is missing a security update. File : fedora_2015-3948.nasl - Type : ACT_GATHER_INFO |
2015-03-24 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201406-11.nasl - Type : ACT_GATHER_INFO |
2015-03-23 | Name : The remote Fedora host is missing a security update. File : fedora_2015-3953.nasl - Type : ACT_GATHER_INFO |
2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_xorg_20141107_2.nasl - Type : ACT_GATHER_INFO |
2014-11-26 | Name : The remote OracleVM host is missing a security update. File : oraclevm_OVMSA-2014-0080.nasl - Type : ACT_GATHER_INFO |
2014-11-26 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1893.nasl - Type : ACT_GATHER_INFO |
2014-11-25 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20141124_libXfont_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2014-11-25 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1893.nasl - Type : ACT_GATHER_INFO |
2014-11-25 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1893.nasl - Type : ACT_GATHER_INFO |
2014-11-21 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2014-1870.nasl - Type : ACT_GATHER_INFO |
2014-11-19 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20141118_libXfont_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2014-11-19 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2014-1870.nasl - Type : ACT_GATHER_INFO |
2014-11-19 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2014-1870.nasl - Type : ACT_GATHER_INFO |
2014-10-12 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2014-404.nasl - Type : ACT_GATHER_INFO |
2014-07-23 | Name : The remote Fedora host is missing a security update. File : fedora_2014-8223.nasl - Type : ACT_GATHER_INFO |
2014-07-17 | Name : The remote host has a version of Oracle Secure Global Desktop that is affecte... File : oracle_secure_global_desktop_jul_2014_cpu.nasl - Type : ACT_GATHER_INFO |
2014-07-16 | Name : The remote Fedora host is missing a security update. File : fedora_2014-8208.nasl - Type : ACT_GATHER_INFO |
2014-07-10 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2014-132.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2014-391.nasl - Type : ACT_GATHER_INFO |
2014-06-11 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_xorg-x11-devel-140515.nasl - Type : ACT_GATHER_INFO |
2014-05-15 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-2211-1.nasl - Type : ACT_GATHER_INFO |
2014-05-14 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2927.nasl - Type : ACT_GATHER_INFO |
2014-05-14 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_b060ee50daba11e399f2bcaec565249c.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2015-03-25 13:28:49 |
|
2014-06-14 13:23:34 |
|