In the PatternMatch function in fontfile/fontdir.c in libXfont through 1.5.2 and 2.x before 2.0.2, an attacker with access to an X connection can cause a buffer over-read during pattern matching of fonts, leading to information disclosure or a crash (denial of service). This occurs because ‘\0’ characters are incorrectly skipped in situations involving ? characters.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | libxfont | < 1:2.0.1-4 | libxfont_1:2.0.1-4_all.deb |
Debian | 11 | all | libxfont | < 1:2.0.1-4 | libxfont_1:2.0.1-4_all.deb |
Debian | 10 | all | libxfont | < 1:2.0.1-4 | libxfont_1:2.0.1-4_all.deb |
Debian | 999 | all | libxfont | < 1:2.0.1-4 | libxfont_1:2.0.1-4_all.deb |
Debian | 13 | all | libxfont | < 1:2.0.1-4 | libxfont_1:2.0.1-4_all.deb |