In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because '\0' characters are incorrectly skipped in situations involving ? characters.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libxfont | Oct 11, 2017 | Oct 10, 2017 |
| Freebsd | — | Upgrade libXfont2Upgrade libXfont | Dec 20, 2017 | Dec 17, 2017 |
| Gentoo Linux | — | Upgrade x11-libs/libXfont2.Upgrade x11-libs/libXfont. | Nov 13, 2017 | Oct 11, 2017 |
| Huawei Euleros 2_0_sp2 | — | — | Dec 4, 2019 | Oct 11, 2017 |
| Huawei Euleros 2_0_sp3 | — | — | Dec 18, 2019 | Oct 11, 2017 |
| Huawei Euleros 2_0_sp5 | — | — | Dec 11, 2019 | Oct 11, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Oct 4, 2017 |
| Suse | — | Upgrade xorg-x11-develUpgrade xorg-x11-libs-x86Upgrade xorg-x11-libsUpgrade xorg-x11-devel-32bitUpgrade libXfont1Upgrade libXfont-develUpgrade xorg-x11-libs-32bit | Dec 9, 2017 | Oct 10, 2017 |
| Ubuntu | — | Upgrade libxfont2Upgrade libxfont1 | Oct 10, 2017 | Oct 10, 2017 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub