{"id": "UBUNTU_USN-2211-1.NASL", "bulletinFamily": "scanner", "title": "Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 / 14.04 LTS : libxfont vulnerabilities (USN-2211-1)", "description": "Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges. (CVE-2014-0209)\n\nIlja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially crafted data that could cause libXfont to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.10. (CVE-2014-0210, CVE-2014-0211).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2014-05-15T00:00:00", "modified": "2016-05-24T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=74022", "reporter": "Tenable", "references": [], "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "type": "nessus", "lastseen": "2017-10-29T13:39:21", "history": [{"bulletin": {"bulletinFamily": "scanner", "cpe": [], "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges. (CVE-2014-0209)\n\nIlja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially crafted data that could cause libXfont to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.10. (CVE-2014-0210, CVE-2014-0211).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "edition": 1, "enchantments": {}, "hash": "a929b1c087bc94ce545e75f3f235b75a3be8cc72c9e3378d6a7d0d471fbc13f0", "hashmap": [{"hash": "c6e219b56aa27b9d5e255342817e79ea", "key": "sourceData"}, {"hash": "5f9fd943c52284c377f38814cd95944f", "key": "pluginID"}, {"hash": "92e0b58c78d1ce72255380829e275c21", "key": "published"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "references"}, {"hash": "2608824fbff43bdc5929127828fd5d55", "key": "cvelist"}, {"hash": "9cf00d658b687f030ebe173a0528c567", "key": "reporter"}, {"hash": "e5d275b3ebd62646b78320753699e02e", "key": "cvss"}, {"hash": "ddab325b78ee84639dc78b61e4febc39", "key": "modified"}, {"hash": "af55d304684a6b8cd57f9069646d5c11", "key": "description"}, {"hash": "bbdaea376f500d25f6b0c1050311dd07", "key": "bulletinFamily"}, {"hash": "5e0bd03bec244039678f2b955a2595aa", "key": "type"}, {"hash": "d82f7ac9b6bdc9ae855336dc72270cd6", "key": "href"}, {"hash": "c9b7d00377a789a14c9bb9dab6c7168c", "key": "naslFamily"}, {"hash": "af6cdfff6a32b741232b2871dbe0d47b", "key": "title"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://www.tenable.com/plugins/index.php?view=single&id=74022", "id": "UBUNTU_USN-2211-1.NASL", "lastseen": "2016-09-26T17:24:57", "modified": "2016-05-24T00:00:00", "naslFamily": "Ubuntu Local Security Checks", "objectVersion": "1.2", "pluginID": "74022", "published": "2014-05-15T00:00:00", "references": [], "reporter": "Tenable", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2211-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(74022);\n script_version(\"$Revision: 1.7 $\");\n script_cvs_date(\"$Date: 2016/05/24 17:29:03 $\");\n\n script_cve_id(\"CVE-2014-0209\", \"CVE-2014-0210\", \"CVE-2014-0211\");\n script_bugtraq_id(67382);\n script_osvdb_id(106970, 106971, 106972, 106973, 106974, 106975, 106976, 106977, 106978, 106979, 106980, 106981);\n script_xref(name:\"USN\", value:\"2211-1\");\n\n script_name(english:\"Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 / 14.04 LTS : libxfont vulnerabilities (USN-2211-1)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Ilja van Sprundel discovered that libXfont incorrectly handled font\nmetadata file parsing. A local attacker could use this issue to cause\nlibXfont to crash, or possibly execute arbitrary code in order to gain\nprivileges. (CVE-2014-0209)\n\nIlja van Sprundel discovered that libXfont incorrectly handled X Font\nServer replies. A malicious font server could return specially crafted\ndata that could cause libXfont to crash, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS,\nUbuntu 12.10 and Ubuntu 13.10. (CVE-2014-0210, CVE-2014-0211).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libxfont1 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libxfont1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:10.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:12.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:12.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:13.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/05/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/05/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2014-2016 Canonical, Inc. / NASL script (C) 2014-2016 Tenable Network Security, Inc.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(10\\.04|12\\.04|12\\.10|13\\.10|14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 10.04 / 12.04 / 12.10 / 13.10 / 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"10.04\", pkgname:\"libxfont1\", pkgver:\"1:1.4.1-1ubuntu0.3\")) flag++;\nif (ubuntu_check(osver:\"12.04\", pkgname:\"libxfont1\", pkgver:\"1:1.4.4-1ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"12.10\", pkgname:\"libxfont1\", pkgver:\"1:1.4.5-2ubuntu0.12.10.2\")) flag++;\nif (ubuntu_check(osver:\"13.10\", pkgname:\"libxfont1\", pkgver:\"1:1.4.6-1ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"libxfont1\", pkgver:\"1:1.4.7-1ubuntu0.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libxfont1\");\n}\n", "title": "Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 / 14.04 LTS : libxfont vulnerabilities (USN-2211-1)", "type": "nessus", "viewCount": 0}, "differentElements": ["cpe"], "edition": 1, "lastseen": "2016-09-26T17:24:57"}], "edition": 2, "hashmap": [{"key": "bulletinFamily", "hash": "bbdaea376f500d25f6b0c1050311dd07"}, {"key": "cpe", "hash": "30aa447e10e80ab7f138ae2a1794964f"}, {"key": "cvelist", "hash": "2608824fbff43bdc5929127828fd5d55"}, {"key": "cvss", "hash": "e5d275b3ebd62646b78320753699e02e"}, {"key": "description", "hash": "af55d304684a6b8cd57f9069646d5c11"}, {"key": "href", "hash": "d82f7ac9b6bdc9ae855336dc72270cd6"}, {"key": "modified", "hash": "ddab325b78ee84639dc78b61e4febc39"}, {"key": "naslFamily", "hash": "c9b7d00377a789a14c9bb9dab6c7168c"}, {"key": "pluginID", "hash": "5f9fd943c52284c377f38814cd95944f"}, {"key": "published", "hash": "92e0b58c78d1ce72255380829e275c21"}, {"key": "references", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "reporter", "hash": "9cf00d658b687f030ebe173a0528c567"}, {"key": "sourceData", "hash": "c6e219b56aa27b9d5e255342817e79ea"}, {"key": "title", "hash": "af6cdfff6a32b741232b2871dbe0d47b"}, {"key": "type", "hash": "5e0bd03bec244039678f2b955a2595aa"}], "hash": "22865091f8c32be032936e0e19b9d7985c1ef86df2f7310cedee4324951cb596", "viewCount": 0, "enchantments": {"vulnersScore": 2.8}, "objectVersion": "1.3", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-2211-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(74022);\n script_version(\"$Revision: 1.7 $\");\n script_cvs_date(\"$Date: 2016/05/24 17:29:03 $\");\n\n script_cve_id(\"CVE-2014-0209\", \"CVE-2014-0210\", \"CVE-2014-0211\");\n script_bugtraq_id(67382);\n script_osvdb_id(106970, 106971, 106972, 106973, 106974, 106975, 106976, 106977, 106978, 106979, 106980, 106981);\n script_xref(name:\"USN\", value:\"2211-1\");\n\n script_name(english:\"Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 / 14.04 LTS : libxfont vulnerabilities (USN-2211-1)\");\n script_summary(english:\"Checks dpkg output for updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Ubuntu host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Ilja van Sprundel discovered that libXfont incorrectly handled font\nmetadata file parsing. A local attacker could use this issue to cause\nlibXfont to crash, or possibly execute arbitrary code in order to gain\nprivileges. (CVE-2014-0209)\n\nIlja van Sprundel discovered that libXfont incorrectly handled X Font\nServer replies. A malicious font server could return specially crafted\ndata that could cause libXfont to crash, or possibly execute arbitrary\ncode. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS,\nUbuntu 12.10 and Ubuntu 13.10. (CVE-2014-0210, CVE-2014-0211).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected libxfont1 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libxfont1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:10.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:12.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:12.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:13.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2014/05/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2014/05/15\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2014-2016 Canonical, Inc. / NASL script (C) 2014-2016 Tenable Network Security, Inc.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(10\\.04|12\\.04|12\\.10|13\\.10|14\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 10.04 / 12.04 / 12.10 / 13.10 / 14.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"10.04\", pkgname:\"libxfont1\", pkgver:\"1:1.4.1-1ubuntu0.3\")) flag++;\nif (ubuntu_check(osver:\"12.04\", pkgname:\"libxfont1\", pkgver:\"1:1.4.4-1ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"12.10\", pkgname:\"libxfont1\", pkgver:\"1:1.4.5-2ubuntu0.12.10.2\")) flag++;\nif (ubuntu_check(osver:\"13.10\", pkgname:\"libxfont1\", pkgver:\"1:1.4.6-1ubuntu0.2\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"libxfont1\", pkgver:\"1:1.4.7-1ubuntu0.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libxfont1\");\n}\n", "naslFamily": "Ubuntu Local Security Checks", "pluginID": "74022", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:libxfont1", "cpe:/o:canonical:ubuntu_linux:13.10", "cpe:/o:canonical:ubuntu_linux:10.04:-:lts", "cpe:/o:canonical:ubuntu_linux:12.10", "cpe:/o:canonical:ubuntu_linux:12.04:-:lts", "cpe:/o:canonical:ubuntu_linux:14.04"]}

{"result": {"cve": [{"id": "CVE-2014-0211", "type": "cve", "title": "CVE-2014-0211", "description": "Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.", "published": "2014-05-15T10:55:07", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0211", "cvelist": ["CVE-2014-0211"], "lastseen": "2017-04-18T15:54:22"}, {"id": "CVE-2014-0209", "type": "cve", "title": "CVE-2014-0209", "description": "Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.", "published": "2014-05-15T10:55:07", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0209", "cvelist": ["CVE-2014-0209"], "lastseen": "2017-04-18T15:54:22"}, {"id": "CVE-2014-0210", "type": "cve", "title": "CVE-2014-0210", "description": "Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.", "published": "2014-05-15T10:55:07", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0210", "cvelist": ["CVE-2014-0210"], "lastseen": "2017-04-18T15:54:22"}], "f5": [{"id": "SOL16118", "type": "f5", "title": "SOL16118 - libXfont vulnerabilities CVE-2014-0209, CVE-2014-0210 and CVE-2014-0211", "description": "Recommended Action\n\nIf the previous table lists a version in the **Versions known to be not vulnerable** column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version in the column, then no upgrade candidate currently exists.\n\nF5 is responding to this vulnerability as determined by the parameters defined in SOL4602: Overview of the F5 security vulnerability response policy.\n\n**ARX**\n\nTo mitigate this vulnerability, do not use X Windows environments when connecting to the ARX command line. \n\n\nSupplemental Information\n\n * SOL9970: Subscribing to email notifications regarding F5 products\n * SOL9957: Creating a custom RSS feed to view new and updated documents\n * SOL4602: Overview of the F5 security vulnerability response policy\n * SOL4918: Overview of the F5 critical issue hotfix policy\n", "published": "2015-02-12T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://support.f5.com/kb/en-us/solutions/public/16000/100/sol16118.html", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2016-09-26T17:23:24"}, {"id": "F5:K16118", "type": "f5", "title": "libXfont vulnerabilities CVE-2014-0209, CVE-2014-0210 and CVE-2014-0211", "description": " \n\n\n[CVE-2014-0209](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0209>)\n\nMultiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.\n\n[CVE-2014-0210](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0210>)\n\nMultiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.\n\n[CVE-2014-0211](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0211>)\n\nMultiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.\n\nImpact \n\n\nA malicious X.org server may cause an X client to crash (CVE-2014-0210 and CVE-2014-0211), or possibly execute arbitrary code with the privileges of the X.org server (CVE-2014-0209, CVE-2014-0210, and CVE-2014-0211).\n\nIf the previous table lists a version in the **Versions known to be not vulnerable** column, you can eliminate this vulnerability by upgrading to the listed version. If the listed version is older than the version you are currently running, or if the table does not list any version in the column, then no upgrade candidate currently exists.\n\nF5 is responding to this vulnerability as determined by the parameters defined in [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>).\n\n**ARX**\n\nTo mitigate this vulnerability, do not use X Windows environments when connecting to the ARX command line. \n\n\n * [K9970: Subscribing to email notifications regarding F5 products](<https://support.f5.com/csp/article/K9970>)\n * [K9957: Creating a custom RSS feed to view new and updated documents](<https://support.f5.com/csp/article/K9957>)\n * [K4602: Overview of the F5 security vulnerability response policy](<https://support.f5.com/csp/article/K4602>)\n * [K4918: Overview of the F5 critical issue hotfix policy](<https://support.f5.com/csp/article/K4918>)\n", "published": "2015-02-13T07:24:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://support.f5.com/csp/article/K16118", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-12T02:11:03"}], "nessus": [{"id": "DEBIAN_DSA-2927.NASL", "type": "nessus", "title": "Debian DSA-2927-1 : libxfont - security update", "description": "Ilja van Sprundel of IOActive discovered several security issues in the X.Org libXfont library, which may allow a local, authenticated user to attempt to raise privileges; or a remote attacker who can control the font server to attempt to execute code with the privileges of the X server.\n\n - CVE-2014-0209 Integer overflow of allocations in font metadata file parsing could allow a local user who is already authenticated to the X server to overwrite other memory in the heap.\n\n - CVE-2014-0210 libxfont does not validate length fields when parsing xfs protocol replies allowing to write past the bounds of allocated memory when storing the returned data from the font server.\n\n - CVE-2014-0211 Integer overflows calculating memory needs for xfs replies could result in allocating too little memory and then writing the returned data from the font server past the end of the allocated buffer.", "published": "2014-05-14T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=73997", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-29T13:44:12"}, {"id": "ORACLELINUX_ELSA-2014-1893.NASL", "type": "nessus", "title": "Oracle Linux 5 : libXfont (ELSA-2014-1893)", "description": "From Red Hat Security Advisory 2014:1893 :\n\nUpdated libXfont packages that fix three security issues are now available for Red Hat Enterprise Linux 5.\n\nRed Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe libXfont packages provide the X.Org libXfont runtime library.\nX.Org is an open source implementation of the X Window System.\n\nA use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.\n(CVE-2014-0209)\n\nMultiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server.\n(CVE-2014-0210, CVE-2014-0211)\n\nRed Hat would like to thank the X.org project for reporting these issues. Upstream acknowledges Ilja van Sprundel as the original reporter.\n\nUsers of libXfont should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running X.Org server instances must be restarted for the update to take effect.", "published": "2014-11-25T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=79424", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-29T13:37:24"}, {"id": "SOLARIS11_XORG_20141107_2.NASL", "type": "nessus", "title": "Oracle Solaris Third-Party Patch Update : xorg (multiple_vulnerabilities_in_x_org2)", "description": "The remote Solaris system is missing necessary patches to address security updates :\n\n - Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata. (CVE-2014-0209)\n\n - Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.\n (CVE-2014-0210)\n\n - Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow. (CVE-2014-0211)", "published": "2015-01-19T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=80823", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-29T13:35:31"}, {"id": "SUSE_11_XORG-X11-DEVEL-140515.NASL", "type": "nessus", "title": "SuSE 11.3 Security Update : xorg-x11-libs (SAT Patch Number 9272)", "description": "xorg-x11-libs was patched to fix the following security issues :\n\n - Integer overflow of allocations in font metadata file parsing. (CVE-2014-0209)\n\n - libxfont not validating length fields when parsing xfs protocol replies. (CVE-2014-0210)\n\n - Integer overflows causing miscalculating memory needs for xfs replies. (CVE-2014-0211) Further information is available at http://lists.x.org/archives/xorg-announce/2014-May/00243 1.html .", "published": "2014-06-11T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=74463", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-29T13:33:49"}, {"id": "FEDORA_2014-8208.NASL", "type": "nessus", "title": "Fedora 20 : libXfont-1.4.8-1.fc20 (2014-8208)", "description": "- libXfont 1.4.8 (rhbz#1100441)\n\n - Fixes: CVE-2014-0209, CVE-2014-0210, CVE-2014-0211 (rhbz#1097397)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2014-07-16T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=76514", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-29T13:35:41"}, {"id": "FEDORA_2014-8223.NASL", "type": "nessus", "title": "Fedora 19 : libXfont-1.4.8-1.fc19 (2014-8223)", "description": "- libXfont 1.4.8 (rhbz#1100441)\n\n - Fixes: CVE-2014-0209, CVE-2014-0210, CVE-2014-0211 (rhbz#1097397)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "published": "2014-07-23T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=76693", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-29T13:37:47"}, {"id": "CENTOS_RHSA-2014-1870.NASL", "type": "nessus", "title": "CentOS 6 / 7 : libXfont (CESA-2014:1870)", "description": "Updated libXfont packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7.\n\nRed Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe libXfont packages provide the X.Org libXfont runtime library.\nX.Org is an open source implementation of the X Window System.\n\nA use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.\n(CVE-2014-0209)\n\nMultiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server.\n(CVE-2014-0210, CVE-2014-0211)\n\nRed Hat would like to thank the X.org project for reporting these issues. Upstream acknowledges Ilja van Sprundel as the original reporter.\n\nUsers of libXfont should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running X.Org server instances must be restarted for the update to take effect.", "published": "2014-11-19T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=79313", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-29T13:35:14"}, {"id": "SL_20141124_LIBXFONT_ON_SL5_X.NASL", "type": "nessus", "title": "Scientific Linux Security Update : libXfont on SL5.x i386/x86_64", "description": "A use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.\n(CVE-2014-0209)\n\nMultiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server.\n(CVE-2014-0210, CVE-2014-0211)\n\nAll running X.Org server instances must be restarted for the update to take effect.", "published": "2014-11-25T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=79427", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-29T13:33:23"}, {"id": "REDHAT-RHSA-2014-1870.NASL", "type": "nessus", "title": "RHEL 6 / 7 : libXfont (RHSA-2014:1870)", "description": "Updated libXfont packages that fix three security issues are now available for Red Hat Enterprise Linux 6 and 7.\n\nRed Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.\n\nThe libXfont packages provide the X.Org libXfont runtime library.\nX.Org is an open source implementation of the X Window System.\n\nA use-after-free flaw was found in the way libXfont processed certain font files when attempting to add a new directory to the font path. A malicious, local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.\n(CVE-2014-0209)\n\nMultiple out-of-bounds write flaws were found in the way libXfont parsed replies received from an X.org font server. A malicious X.org server could cause an X client to crash or, possibly, execute arbitrary code with the privileges of the X.Org server.\n(CVE-2014-0210, CVE-2014-0211)\n\nRed Hat would like to thank the X.org project for reporting these issues. Upstream acknowledges Ilja van Sprundel as the original reporter.\n\nUsers of libXfont should upgrade to these updated packages, which contain a backported patch to resolve this issue. All running X.Org server instances must be restarted for the update to take effect.", "published": "2014-11-19T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=79327", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-29T13:38:59"}, {"id": "ALA_ALAS-2014-404.NASL", "type": "nessus", "title": "Amazon Linux AMI : libXfont (ALAS-2014-404)", "description": "Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.\n\nMultiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.\n\nMultiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.", "published": "2014-10-12T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=78347", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2018-04-19T08:13:08"}], "debian": [{"id": "DSA-2927", "type": "debian", "title": "libxfont -- security update", "description": "Ilja van Sprundel of IOActive discovered several security issues in the X.Org libXfont library, which may allow a local, authenticated user to attempt to raise privileges; or a remote attacker who can control the font server to attempt to execute code with the privileges of the X server.\n\n * [CVE-2014-0209](<https://security-tracker.debian.org/tracker/CVE-2014-0209>)\n\nInteger overflow of allocations in font metadata file parsing could allow a local user who is already authenticated to the X server to overwrite other memory in the heap.\n\n * [CVE-2014-0210](<https://security-tracker.debian.org/tracker/CVE-2014-0210>)\n\nlibxfont does not validate length fields when parsing xfs protocol replies allowing to write past the bounds of allocated memory when storing the returned data from the font server.\n\n * [CVE-2014-0211](<https://security-tracker.debian.org/tracker/CVE-2014-0211>)\n\nInteger overflows calculating memory needs for xfs replies could result in allocating too little memory and then writing the returned data from the font server past the end of the allocated buffer.\n\nFor the oldstable distribution (squeeze), these problems have been fixed in version 1:1.4.1-5.\n\nFor the stable distribution (wheezy), these problems have been fixed in version 1:1.4.5-4.\n\nFor the unstable distribution (sid), these problems have been fixed in version 1:1.4.7-2.\n\nWe recommend that you upgrade your libxfont packages.", "published": "2014-05-13T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://www.debian.org/security/dsa-2927", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-08T01:31:14"}], "redhat": [{"id": "RHSA-2014:1893", "type": "redhat", "title": "(RHSA-2014:1893) Important: libXfont security update", "description": "The libXfont packages provide the X.Org libXfont runtime library. X.Org is\nan open source implementation of the X Window System.\n\nA use-after-free flaw was found in the way libXfont processed certain font\nfiles when attempting to add a new directory to the font path. A malicious,\nlocal user could exploit this issue to potentially execute arbitrary code\nwith the privileges of the X.Org server. (CVE-2014-0209)\n\nMultiple out-of-bounds write flaws were found in the way libXfont parsed\nreplies received from an X.org font server. A malicious X.org server could\ncause an X client to crash or, possibly, execute arbitrary code with the\nprivileges of the X.Org server. (CVE-2014-0210, CVE-2014-0211)\n\nRed Hat would like to thank the X.org project for reporting these issues.\nUpstream acknowledges Ilja van Sprundel as the original reporter.\n\nUsers of libXfont should upgrade to these updated packages, which contain a\nbackported patch to resolve this issue. All running X.Org server instances\nmust be restarted for the update to take effect.\n", "published": "2014-11-24T05:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2014:1893", "cvelist": ["CVE-2014-0209", "CVE-2014-0210", "CVE-2014-0211"], "lastseen": "2017-09-09T07:19:50"}, {"id": "RHSA-2014:1870", "type": "redhat", "title": "(RHSA-2014:1870) Important: libXfont security update", "description": "The libXfont packages provide the X.Org libXfont runtime library. X.Org is\nan open source implementation of the X Window System.\n\nA use-after-free flaw was found in the way libXfont processed certain font\nfiles when attempting to add a new directory to the font path. A malicious,\nlocal user could exploit this issue to potentially execute arbitrary code\nwith the privileges of the X.Org server. (CVE-2014-0209)\n\nMultiple out-of-bounds write flaws were found in the way libXfont parsed\nreplies received from an X.org font server. A malicious X.org server could\ncause an X client to crash or, possibly, execute arbitrary code with the\nprivileges of the X.Org server. (CVE-2014-0210, CVE-2014-0211)\n\nRed Hat would like to thank the X.org project for reporting these issues.\nUpstream acknowledges Ilja van Sprundel as the original reporter.\n\nUsers of libXfont should upgrade to these updated packages, which contain a\nbackported patch to resolve this issue. All running X.Org server instances\nmust be restarted for the update to take effect.\n", "published": "2014-11-18T05:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://access.redhat.com/errata/RHSA-2014:1870", "cvelist": ["CVE-2014-0209", "CVE-2014-0210", "CVE-2014-0211"], "lastseen": "2018-04-15T16:22:24"}], "ubuntu": [{"id": "USN-2211-1", "type": "ubuntu", "title": "libXfont vulnerabilities", "description": "Ilja van Sprundel discovered that libXfont incorrectly handled font metadata file parsing. A local attacker could use this issue to cause libXfont to crash, or possibly execute arbitrary code in order to gain privileges. (CVE-2014-0209)\n\nIlja van Sprundel discovered that libXfont incorrectly handled X Font Server replies. A malicious font server could return specially-crafted data that could cause libXfont to crash, or possibly execute arbitrary code. This issue only affected Ubuntu 10.04 LTS, Ubuntu 12.04 LTS, Ubuntu 12.10 and Ubuntu 13.10. (CVE-2014-0210, CVE-2014-0211)", "published": "2014-05-14T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://usn.ubuntu.com/2211-1/", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2018-03-29T18:21:08"}], "openvas": [{"id": "OPENVAS:1361412562310871295", "type": "openvas", "title": "RedHat Update for libXfont RHSA-2014:1870-01", "description": "Check the version of libXfont", "published": "2014-11-19T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871295", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-08-03T10:49:17"}, {"id": "OPENVAS:1361412562310882085", "type": "openvas", "title": "CentOS Update for libXfont CESA-2014:1870 centos7 ", "description": "Check the version of libXfont", "published": "2014-11-19T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882085", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-07-28T10:48:44"}, {"id": "OPENVAS:1361412562310123247", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2014-1870", "description": "Oracle Linux Local Security Checks ELSA-2014-1870", "published": "2015-10-06T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123247", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-07-24T12:52:37"}, {"id": "OPENVAS:1361412562310123241", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2014-1893", "description": "Oracle Linux Local Security Checks ELSA-2014-1893", "published": "2015-10-06T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310123241", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-07-24T12:53:32"}, {"id": "OPENVAS:1361412562310841825", "type": "openvas", "title": "Ubuntu Update for libxfont USN-2211-1", "description": "Check for the Version of libxfont", "published": "2014-05-19T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310841825", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2018-04-09T11:14:01"}, {"id": "OPENVAS:702927", "type": "openvas", "title": "Debian Security Advisory DSA 2927-1 (libxfont - security update)", "description": "Ilja van Sprundel of IOActive discovered several security issues in the\nX.Org libXfont library, which may allow a local, authenticated user to\nattempt to raise privileges; or a remote attacker who can control the\nfont server to attempt to execute code with the privileges of the X\nserver.\n\nCVE-2014-0209 \nInteger overflow of allocations in font metadata file parsing could\nallow a local user who is already authenticated to the X server to\noverwrite other memory in the heap.\n\nCVE-2014-0210 \nlibxfont does not validate length fields when parsing xfs protocol\nreplies allowing to write past the bounds of allocated memory when\nstoring the returned data from the font server.\n\nCVE-2014-0211 \nInteger overflows calculating memory needs for xfs replies could\nresult in allocating too little memory and then writing the returned\ndata from the font server past the end of the allocated buffer.", "published": "2014-05-13T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=702927", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-07-28T10:49:04"}, {"id": "OPENVAS:1361412562310702927", "type": "openvas", "title": "Debian Security Advisory DSA 2927-1 (libxfont - security update)", "description": "Ilja van Sprundel of IOActive discovered several security issues in the\nX.Org libXfont library, which may allow a local, authenticated user to\nattempt to raise privileges; or a remote attacker who can control the\nfont server to attempt to execute code with the privileges of the X\nserver.\n\nCVE-2014-0209 \nInteger overflow of allocations in font metadata file parsing could\nallow a local user who is already authenticated to the X server to\noverwrite other memory in the heap.\n\nCVE-2014-0210 \nlibxfont does not validate length fields when parsing xfs protocol\nreplies allowing to write past the bounds of allocated memory when\nstoring the returned data from the font server.\n\nCVE-2014-0211 \nInteger overflows calculating memory needs for xfs replies could\nresult in allocating too little memory and then writing the returned\ndata from the font server past the end of the allocated buffer.", "published": "2014-05-13T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310702927", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2018-04-06T11:12:58"}, {"id": "OPENVAS:1361412562310120495", "type": "openvas", "title": "Amazon Linux Local Check: ALAS-2014-404", "description": "Amazon Linux Local Security Checks", "published": "2015-09-08T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310120495", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-09-04T14:12:50"}, {"id": "OPENVAS:1361412562310882086", "type": "openvas", "title": "CentOS Update for libXfont CESA-2014:1870 centos6 ", "description": "Check the version of libXfont", "published": "2014-11-19T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310882086", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-07-28T10:48:37"}, {"id": "OPENVAS:1361412562310121214", "type": "openvas", "title": "Gentoo Linux Local Check: https://security.gentoo.org/glsa/201406-11", "description": "Gentoo Linux Local Security Checks https://security.gentoo.org/glsa/201406-11", "published": "2015-09-29T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310121214", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2018-04-09T11:26:04"}], "centos": [{"id": "CESA-2014:1893", "type": "centos", "title": "libXfont security update", "description": "**CentOS Errata and Security Advisory** CESA-2014:1893\n\n\nThe libXfont packages provide the X.Org libXfont runtime library. X.Org is\nan open source implementation of the X Window System.\n\nA use-after-free flaw was found in the way libXfont processed certain font\nfiles when attempting to add a new directory to the font path. A malicious,\nlocal user could exploit this issue to potentially execute arbitrary code\nwith the privileges of the X.Org server. (CVE-2014-0209)\n\nMultiple out-of-bounds write flaws were found in the way libXfont parsed\nreplies received from an X.org font server. A malicious X.org server could\ncause an X client to crash or, possibly, execute arbitrary code with the\nprivileges of the X.Org server. (CVE-2014-0210, CVE-2014-0211)\n\nRed Hat would like to thank the X.org project for reporting these issues.\nUpstream acknowledges Ilja van Sprundel as the original reporter.\n\nUsers of libXfont should upgrade to these updated packages, which contain a\nbackported patch to resolve this issue. All running X.Org server instances\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2014-November/020782.html\n\n**Affected packages:**\nlibXfont\nlibXfont-devel\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2014-1893.html", "published": "2014-11-25T11:10:27", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2014-November/020782.html", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-03T18:26:00"}, {"id": "CESA-2014:1870", "type": "centos", "title": "libXfont security update", "description": "**CentOS Errata and Security Advisory** CESA-2014:1870\n\n\nThe libXfont packages provide the X.Org libXfont runtime library. X.Org is\nan open source implementation of the X Window System.\n\nA use-after-free flaw was found in the way libXfont processed certain font\nfiles when attempting to add a new directory to the font path. A malicious,\nlocal user could exploit this issue to potentially execute arbitrary code\nwith the privileges of the X.Org server. (CVE-2014-0209)\n\nMultiple out-of-bounds write flaws were found in the way libXfont parsed\nreplies received from an X.org font server. A malicious X.org server could\ncause an X client to crash or, possibly, execute arbitrary code with the\nprivileges of the X.Org server. (CVE-2014-0210, CVE-2014-0211)\n\nRed Hat would like to thank the X.org project for reporting these issues.\nUpstream acknowledges Ilja van Sprundel as the original reporter.\n\nUsers of libXfont should upgrade to these updated packages, which contain a\nbackported patch to resolve this issue. All running X.Org server instances\nmust be restarted for the update to take effect.\n\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-announce/2014-November/020768.html\nhttp://lists.centos.org/pipermail/centos-announce/2014-November/020769.html\n\n**Affected packages:**\nlibXfont\nlibXfont-devel\n\n**Upstream details at:**\nhttps://rhn.redhat.com/errata/RHSA-2014-1870.html", "published": "2014-11-18T14:18:34", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://lists.centos.org/pipermail/centos-announce/2014-November/020768.html", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2017-10-03T18:25:57"}], "gentoo": [{"id": "GLSA-201406-11", "type": "gentoo", "title": "libXfont: Multiple vulnerabilities", "description": "### Background\n\nlibXfont is an X11 font rasterisation library. \n\n### Description\n\nMultiple vulnerabilities have been discovered in libXfont. Please review the CVE identifiers referenced below for details. \n\n### Impact\n\nA context-dependent attacker could use a specially crafted file to gain privileges, cause a Denial of Service condition or possibly execute arbitrary code with the privileges of the process. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll libXfont users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=x11-libs/libXfont-1.4.8\"", "published": "2014-06-14T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://security.gentoo.org/glsa/201406-11", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2016-09-06T19:46:03"}], "oraclelinux": [{"id": "ELSA-2014-1893", "type": "oraclelinux", "title": "libXfont security update", "description": "[1.2.2-1.0.6]\n- CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601)\n- CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601)\n- CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601)", "published": "2014-11-24T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://linux.oracle.com/errata/ELSA-2014-1893.html", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2016-09-04T11:16:31"}, {"id": "ELSA-2014-1870", "type": "oraclelinux", "title": "libXfont security update", "description": "[1.4.5-4]\n- CVE-2014-0209: integer overflow of allocations in font metadata file parsing (bug 1163602, bug 1163601)\n- CVE-2014-0210: unvalidated length fields when parsing xfs protocol replies (bug 1163602, bug 1163601)\n- CVE-2014-0211: integer overflows calculating memory needs for xfs replies (bug 1163602, bug 1163601)", "published": "2014-11-18T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "http://linux.oracle.com/errata/ELSA-2014-1870.html", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2016-09-04T11:16:54"}], "freebsd": [{"id": "B060EE50-DABA-11E3-99F2-BCAEC565249C", "type": "freebsd", "title": "libXfont -- X Font Service Protocol and Font metadata file handling issues", "description": "\nAlan Coopersmith reports:\n\nIlja van Sprundel, a security researcher with IOActive, has\n\t discovered several issues in the way the libXfont library\n\t handles the responses it receives from xfs servers, and has\n\t worked with X.Org's security team to analyze, confirm, and fix\n\t these issues.\nMost of these issues stem from libXfont trusting the font server\n\t to send valid protocol data, and not verifying that the values\n\t will not overflow or cause other damage. This code is commonly\n\t called from the X server when an X Font Server is active in the\n\t font path, so may be running in a setuid-root process depending\n\t on the X server in use. Exploits of this path could be used by\n\t a local, authenticated user to attempt to raise privileges; or\n\t by a remote attacker who can control the font server to attempt\n\t to execute code with the privileges of the X server.\n\n", "published": "2014-05-13T00:00:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://vuxml.freebsd.org/freebsd/b060ee50-daba-11e3-99f2-bcaec565249c.html", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2016-09-26T17:24:25"}], "amazon": [{"id": "ALAS-2014-404", "type": "amazon", "title": "Medium: libXfont", "description": "**Issue Overview:**\n\nMultiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.\n\nMultiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.\n\nMultiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.\n\n \n**Affected Packages:** \n\n\nlibXfont\n\n \n**Issue Correction:** \nRun _yum update libXfont_ to update your system. \n\n \n**New Packages:**\n \n \n i686: \n libXfont-1.4.5-3.9.amzn1.i686 \n libXfont-devel-1.4.5-3.9.amzn1.i686 \n libXfont-debuginfo-1.4.5-3.9.amzn1.i686 \n \n src: \n libXfont-1.4.5-3.9.amzn1.src \n \n x86_64: \n libXfont-1.4.5-3.9.amzn1.x86_64 \n libXfont-debuginfo-1.4.5-3.9.amzn1.x86_64 \n libXfont-devel-1.4.5-3.9.amzn1.x86_64 \n \n \n", "published": "2014-09-17T21:44:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://alas.aws.amazon.com/ALAS-2014-404.html", "cvelist": ["CVE-2014-0211", "CVE-2014-0209", "CVE-2014-0210"], "lastseen": "2016-09-28T21:04:06"}], "oracle": [{"id": "ORACLE:CPUJUL2014-1972956", "type": "oracle", "title": "Oracle Critical Patch Update - July 2014", "description": "A Critical Patch Update (CPU) is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are generally cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update advisories should be reviewed for information regarding earlier published security fixes. Please refer to:\n\n[Critical Patch Updates and Security Alerts](<http://www.oracle.com/technetwork/topics/security/alerts-086861.html>) for information about Oracle Security Advisories.\n\n**Due to the threat posed by a successful attack, Oracle strongly recommends that customers apply CPU fixes as soon as possible.** This Critical Patch Update contains 113 new security fixes across the product families listed below.\n\nPlease note that a blog entry summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at <https://blogs.oracle.com/security>.\n\nThis Critical Patch Update advisory is also available in an XML format that conforms to the Common Vulnerability Reporting Format (CVRF) version 1.1. More information about Oracle's use of CVRF is available at: <http://www.oracle.com/technetwork/topics/security/cpufaq-098434.html#CVRF>.\n\nPlease note that on April 18, 2014, Oracle released a [Security Alert for CVE-2014-0160 OpenSSL \"Heartbleed\"](<http://www.oracle.com/technetwork/topics/security/alert-cve-2014-0160-2190703.html>). This Critical Patch Update includes an update to MySQL Enterprise Server 5.6 and this update includes a fix for vulnerability CVE-2014-0160. Customers of other Oracle products are strongly advised to apply the [fixes ](<http://www.oracle.com/technetwork/topics/security/opensslheartbleedcve-2014-0160-2188454.html>) that were announced in the Security Alert for CVE-2014-0160.\n", "published": "2014-07-15T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "", "cvelist": ["CVE-2014-2482", "CVE-2012-3544", "CVE-2014-4224", "CVE-2014-4208", "CVE-2014-4213", "CVE-2014-4262", "CVE-2014-4242", "CVE-2014-2490", "CVE-2014-4226", "CVE-2014-4251", "CVE-2014-4263", "CVE-2014-4238", "CVE-2014-2481", "CVE-2013-3774", "CVE-2014-2480", "CVE-2014-4250", "CVE-2014-4260", "CVE-2014-2479", "CVE-2014-4218", "CVE-2014-4254", "CVE-2014-4258", "CVE-2014-4221", "CVE-2013-6449", "CVE-2014-4255", "CVE-2014-4253", "CVE-2014-4268", "CVE-2013-2172", "CVE-2014-4203", "CVE-2014-4265", "CVE-2014-4231", "CVE-2014-4201", "CVE-2014-4233", "CVE-2013-5855", "CVE-2014-4210", "CVE-2014-4229", "CVE-2013-5605", "CVE-2014-0224", "CVE-2014-4267", "CVE-2014-4266", "CVE-2014-2486", "CVE-2014-4270", "CVE-2014-0098", "CVE-2014-4214", "CVE-2014-2485", "CVE-2014-4222", "CVE-2013-1741", "CVE-2014-4257", "CVE-2014-4244", "CVE-2014-2494", "CVE-2014-2487", "CVE-2014-4205", "CVE-2014-4261", "CVE-2014-0436", "CVE-2013-1740", "CVE-2014-2493", "CVE-2014-4206", "CVE-2014-0099", "CVE-2013-6438", "CVE-2014-3470", "CVE-2014-2488", "CVE-2013-1739", "CVE-2014-4215", "CVE-2014-0119", "CVE-2014-1492", "CVE-2014-4209", "CVE-2013-6450", "CVE-2014-4245", "CVE-2013-5606", "CVE-2014-0114", "CVE-2014-0211", "CVE-2013-4322", "CVE-2014-0050", "CVE-2013-2461", "CVE-2014-1490", "CVE-2010-5298", "CVE-2014-0160", "CVE-2013-4286", "CVE-2014-0209", "CVE-2014-0210", "CVE-2014-4234", "CVE-2014-2489", "CVE-2014-0195", "CVE-2014-4269", "CVE-2014-0198", "CVE-2014-4216", "CVE-2014-4230", "CVE-2013-3751", "CVE-2014-4264", "CVE-2014-2477", "CVE-2014-4220", "CVE-2014-4237", "CVE-2014-4204", "CVE-2014-0096", "CVE-2014-4243", "CVE-2014-4217", "CVE-2014-4239", "CVE-2014-4248", "CVE-2014-0075", "CVE-2014-4211", "CVE-2014-2496", "CVE-2014-2483", "CVE-2014-4235", "CVE-2014-0033", "CVE-2014-4225", "CVE-2014-4241", "CVE-2014-4246", "CVE-2014-4207", "CVE-2014-4232", "CVE-2014-4256", "CVE-2014-1491", "CVE-2014-4227", "CVE-2014-4247", "CVE-2014-4252", "CVE-2014-2492", "CVE-2014-4228", "CVE-2014-4202", "CVE-2014-4212", "CVE-2014-2484", "CVE-2014-4236", "CVE-2014-4240", "CVE-2014-4219", "CVE-2014-2456", "CVE-2014-4249", "CVE-2013-1620", "CVE-2014-4223", "CVE-2014-4271", "CVE-2014-0221", "CVE-2014-2491", "CVE-2014-2495"], "lastseen": "2018-04-18T20:23:45"}]}}