Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name MDVSA-2014:132 First vendor Publication 2014-07-09
Vendor Mandriva Last vendor Modification 2014-07-09
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Updated libxfont packages fix security vulnerabilities:

Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges (CVE-2014-0209).

Ilja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially-crafted data that could cause libXfont to crash, or possibly execute arbitrary code (CVE-2014-0210, CVE-2014-0211).

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2014:132

CWE : Common Weakness Enumeration

% Id Name
67 % CWE-189 Numeric Errors (CWE/SANS Top 25)
33 % CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:24797
 
Oval ID: oval:org.mitre.oval:def:24797
Title: USN-2211-1 -- libxfont vulnerabilities
Description: Several security issues were fixed in libXfont.
Family: unix Class: patch
Reference(s): USN-2211-1
CVE-2014-0209
CVE-2014-0210
CVE-2014-0211
Version: 5
Platform(s): Ubuntu 14.04
Ubuntu 13.10
Ubuntu 12.10
Ubuntu 12.04
Ubuntu 10.04
Product(s): libxfont
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:24874
 
Oval ID: oval:org.mitre.oval:def:24874
Title: DSA-2927-1 libxfont - security update
Description: Ilja van Sprundel of IOActive discovered several security issues in theX.Org libXfont library, which may allow a local, authenticated user to attempt to raise privileges; or a remote attacker who can control the font server to attempt to execute code with the privileges of the X server.
Family: unix Class: patch
Reference(s): DSA-2927-1
CVE-2014-0209
CVE-2014-0210
CVE-2014-0211
Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/Linux 7
Debian GNU/kFreeBSD 6.0
Debian GNU/kFreeBSD 7
Product(s): libxfont
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25303
 
Oval ID: oval:org.mitre.oval:def:25303
Title: SUSE-SU-2014:0774-1 -- Security update for xorg-x11-libs
Description: xorg-x11-libs was patched to fix the following security issues: * Integer overflow of allocations in font metadata file parsing. (CVE-2014-0209) * libxfont not validating length fields when parsing xfs protocol replies. (CVE-2014-0210) * Integer overflows causing miscalculating memory needs for xfs replies. (CVE-2014-0211)
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0774-1
CVE-2014-0209
CVE-2014-0210
CVE-2014-0211
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
SUSE Linux Enterprise Desktop 11
Product(s): xorg-x11-libs
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:25958
 
Oval ID: oval:org.mitre.oval:def:25958
Title: SUSE-SU-2014:0881-1 -- Security update for xorg-x11-libs
Description: This is a SUSE Linux Enterprise Server 11 SP1 LTSS roll up update of xorg-x11-libs, fixing security issues and some bugs.
Family: unix Class: patch
Reference(s): SUSE-SU-2014:0881-1
CVE-2013-1984
CVE-2013-1985
CVE-2013-1986
CVE-2013-1988
CVE-2013-1990
CVE-2013-1991
CVE-2013-1992
CVE-2013-1995
CVE-2013-1996
CVE-2013-1998
CVE-2013-1999
CVE-2013-2000
CVE-2013-2001
CVE-2013-2003
CVE-2013-2063
CVE-2013-6462
CVE-2014-0209
CVE-2014-0210
CVE-2014-0211
Version: 3
Platform(s): SUSE Linux Enterprise Server 11
Product(s): xorg-x11-libs
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:27716
 
Oval ID: oval:org.mitre.oval:def:27716
Title: RHSA-2014:1893 -- libXfont security update (Important)
Description: The libXfont packages provide the X.Org libXfont runtime library. X.Org is an open source implementation of the X Window System. A use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server. (CVE-2014-0209) Multiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server. (CVE-2014-0210, CVE-2014-0211) Red Hat would like to thank the X.org project for reporting these issues. Upstream acknowledges Ilja van Sprundel as the original reporter. Users of libXfont should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running X.Org server instances must be restarted for the update to take effect.
Family: unix Class: patch
Reference(s): RHSA-2014:1893
CESA-2014:1893
CVE-2014-0209
CVE-2014-0210
CVE-2014-0211
Version: 3
Platform(s): Red Hat Enterprise Linux 5
CentOS Linux 5
Product(s): libXfont
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28393
 
Oval ID: oval:org.mitre.oval:def:28393
Title: ELSA-2014-1870 -- libXfont security update (important)
Description: [1.4.5-4] - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601) - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601) - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601)
Family: unix Class: patch
Reference(s): ELSA-2014-1870
CVE-2014-0209
CVE-2014-0210
CVE-2014-0211
Version: 3
Platform(s): Oracle Linux 6
Oracle Linux 7
Product(s): libXfont
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28414
 
Oval ID: oval:org.mitre.oval:def:28414
Title: ELSA-2014-1893 -- libXfont security update (important)
Description: [1.2.2-1.0.6] - CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601) - CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601) - CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601)
Family: unix Class: patch
Reference(s): ELSA-2014-1893
CVE-2014-0209
CVE-2014-0210
CVE-2014-0211
Version: 3
Platform(s): Oracle Linux 5
Product(s): libXfont
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28435
 
Oval ID: oval:org.mitre.oval:def:28435
Title: RHSA-2014:1870 -- libXfont security update (Important)
Description: The libXfont packages provide the X.Org libXfont runtime library. X.Org is an open source implementation of the X Window System. A use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server. (CVE-2014-0209) Multiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server. (CVE-2014-0210, CVE-2014-0211) Red Hat would like to thank the X.org project for reporting these issues. Upstream acknowledges Ilja van Sprundel as the original reporter. Users of libXfont should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running X.Org server instances must be restarted for the update to take effect.
Family: unix Class: patch
Reference(s): RHSA-2014:1870
CESA-2014:1870-CentOS 6
CESA-2014:1870-CentOS 7
CVE-2014-0209
CVE-2014-0210
CVE-2014-0211
Version: 3
Platform(s): Red Hat Enterprise Linux 6
Red Hat Enterprise Linux 7
CentOS Linux 6
CentOS Linux 7
Product(s): libXfont
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 26
Os 5

Nessus® Vulnerability Scanner

Date Description
2015-03-30 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2015-145.nasl - Type : ACT_GATHER_INFO
2015-03-27 Name : The remote Fedora host is missing a security update.
File : fedora_2015-3964.nasl - Type : ACT_GATHER_INFO
2015-03-27 Name : The remote Fedora host is missing a security update.
File : fedora_2015-3948.nasl - Type : ACT_GATHER_INFO
2015-03-24 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201406-11.nasl - Type : ACT_GATHER_INFO
2015-03-23 Name : The remote Fedora host is missing a security update.
File : fedora_2015-3953.nasl - Type : ACT_GATHER_INFO
2015-01-19 Name : The remote Solaris system is missing a security patch for third-party software.
File : solaris11_xorg_20141107_2.nasl - Type : ACT_GATHER_INFO
2014-11-26 Name : The remote OracleVM host is missing a security update.
File : oraclevm_OVMSA-2014-0080.nasl - Type : ACT_GATHER_INFO
2014-11-26 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1893.nasl - Type : ACT_GATHER_INFO
2014-11-25 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20141124_libXfont_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2014-11-25 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1893.nasl - Type : ACT_GATHER_INFO
2014-11-25 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1893.nasl - Type : ACT_GATHER_INFO
2014-11-21 Name : The remote Oracle Linux host is missing one or more security updates.
File : oraclelinux_ELSA-2014-1870.nasl - Type : ACT_GATHER_INFO
2014-11-19 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20141118_libXfont_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2014-11-19 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2014-1870.nasl - Type : ACT_GATHER_INFO
2014-11-19 Name : The remote CentOS host is missing one or more security updates.
File : centos_RHSA-2014-1870.nasl - Type : ACT_GATHER_INFO
2014-10-12 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2014-404.nasl - Type : ACT_GATHER_INFO
2014-07-23 Name : The remote Fedora host is missing a security update.
File : fedora_2014-8223.nasl - Type : ACT_GATHER_INFO
2014-07-17 Name : The remote host has a version of Oracle Secure Global Desktop that is affecte...
File : oracle_secure_global_desktop_jul_2014_cpu.nasl - Type : ACT_GATHER_INFO
2014-07-16 Name : The remote Fedora host is missing a security update.
File : fedora_2014-8208.nasl - Type : ACT_GATHER_INFO
2014-07-10 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2014-132.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2014-391.nasl - Type : ACT_GATHER_INFO
2014-06-11 Name : The remote SuSE 11 host is missing one or more security updates.
File : suse_11_xorg-x11-devel-140515.nasl - Type : ACT_GATHER_INFO
2014-05-15 Name : The remote Ubuntu host is missing a security-related patch.
File : ubuntu_USN-2211-1.nasl - Type : ACT_GATHER_INFO
2014-05-14 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2927.nasl - Type : ACT_GATHER_INFO
2014-05-14 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_b060ee50daba11e399f2bcaec565249c.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2014-07-11 13:25:13
  • Multiple Updates
2014-07-09 17:22:59
  • First insertion