Homepage

Numeric Errors The advisory has been revoked - it doesn't affect any version of package libxfont  (opens in a new tab)

Threat Intelligence

EPSS
4.36% (90th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1404-LIBXFONT-633031
  • published15 May 2014
  • disclosed15 May 2014
Report a new vulnerability Found a mistake?

Introduced: 15 May 2014

CVE-2014-0211  (opens in a new tab)
CWE-189  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:14.04.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libxfont package and not the libxfont package as distributed by Ubuntu.

Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.

References