Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in a character name in a BDF font file.
CVSS Details
- CVSS 3.1 Base Score: 8.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade libxfont | Aug 30, 2017 | Jan 9, 2014 |
| Centos_linux | — | Upgrade libXfontUpgrade libXfont-devel | Dec 1, 2016 | Jan 9, 2014 |
| Debian | — | Upgrade libxfont | Jul 30, 2024 | Jan 9, 2014 |
| Freebsd | — | Upgrade libXfont | Dec 10, 2025 | Jan 8, 2014 |
| Gentoo Linux | — | Upgrade x11-libs/libXfont. | Oct 30, 2017 | Jan 9, 2014 |
| Oracle Solaris | — | Upgrade x11/server/xvfb to version 1.12.2-0.175.1.16.0.4.1345 on Solaris 11.1Upgrade x11/server/xvnc to version 1.1.0-0.175.1.16.0.4.1345 on Solaris 11.1Upgrade x11/library/libxfont to version 1.4.5-0.175.1.16.0.4.1345 on Solaris 11.1Upgrade x11/server/xephyr to version 1.12.2-0.175.1.16.0.4.1345 on Solaris 11.1 | May 29, 2017 | Jan 9, 2014 |
| Oracle_linux | — | Upgrade libXfontUpgrade libXfont-devel | Oct 16, 2024 | Jan 9, 2014 |
| Suse | — | Upgrade libXfont-devel-32bitUpgrade xorg-x11-devel-32bitUpgrade xorg-x11-develUpgrade libXfont-develUpgrade xorg-x11-libs-32bitUpgrade xorg-x11-libs-x86Upgrade libXfont1Upgrade libXfontUpgrade xorg-x11-libsUpgrade sle-sdk-releaseUpgrade libXfont1-32bit | Jan 16, 2014 | Jan 9, 2014 |
| Ubuntu | — | Upgrade libxfont1 | Nov 8, 2024 | Jan 9, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub