Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.
CVSS Details
- CVSS 3.1 Base Score: 8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx X11 | — | Apply OS X security update 2009-001 | Dec 16, 2011 | Apr 5, 2007 |
| Debian | — | Upgrade freetypeUpgrade libxfont | Jul 30, 2024 | Apr 6, 2007 |
| Gentoo Linux | — | Upgrade net-misc/tightvnc.Upgrade x11-libs/libXfont.Upgrade media-libs/freetype. | Oct 30, 2017 | Apr 5, 2007 |
| Oracle_linux | — | Upgrade libXfont-develUpgrade libXfont | Oct 16, 2024 | Apr 6, 2007 |
| Suse | — | Upgrade ftdiffUpgrade freetype2-develUpgrade freetype2-devel-32bitUpgrade ftviewUpgrade libfreetype6Upgrade freetype2Upgrade ftdumpUpgrade ftlintUpgrade ftgridUpgrade ftvalidUpgrade freetype2-profile-tti35Upgrade ftmultiUpgrade ft2demosUpgrade ftbenchUpgrade ftgammaUpgrade ftstringUpgrade ftsdfUpgrade freetype2-32bitUpgrade freetype2-x86 | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libfreetype6Upgrade xserver-xorg-coreUpgrade libxfont1 | Nov 8, 2024 | Apr 6, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub