Some buffer overflows were discovered in the CID font parser,
potentially resulting in the execution of arbitrary code with elevated
privileges.
Background
==========
libXfont is the X.Org Xfont library, some parts are based on the
FreeType code base.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 x11-libs/libXfont < 1.2.1 >= 1.2.1
2 x11-base/xorg-x11 < 7.0 >= 7.0
-------------------------------------------------------------------
2 affected packages on all of their supported architectures.
-------------------------------------------------------------------
Description
===========
Several integer overflows have been found in the CID font parser.
Impact
======
A remote attacker could exploit this vulnerability by enticing a user
to load a malicious font file resulting in the execution of arbitrary
code with the permissions of the user running the X server which
typically is the root user. A local user could exploit this
vulnerability to gain elevated privileges.
Workaround
==========
Disable CID-encoded Type 1 fonts by removing the "type1" module and
replacing it with the "freetype" module in xorg.conf.
Resolution
==========
All libXfont users should upgrade to the latest version:
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security (at) gentoo (dot) org [email concealed] or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
Gentoo Linux Security Advisory GLSA 200609-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: High
Title: LibXfont, monolithic X.org: Multiple integer overflows
Date: September 13, 2006
Bugs: #145513
ID: 200609-07
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Some buffer overflows were discovered in the CID font parser,
potentially resulting in the execution of arbitrary code with elevated
privileges.
Background
==========
libXfont is the X.Org Xfont library, some parts are based on the
FreeType code base.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 x11-libs/libXfont < 1.2.1 >= 1.2.1
2 x11-base/xorg-x11 < 7.0 >= 7.0
-------------------------------------------------------------------
2 affected packages on all of their supported architectures.
-------------------------------------------------------------------
Description
===========
Several integer overflows have been found in the CID font parser.
Impact
======
A remote attacker could exploit this vulnerability by enticing a user
to load a malicious font file resulting in the execution of arbitrary
code with the permissions of the user running the X server which
typically is the root user. A local user could exploit this
vulnerability to gain elevated privileges.
Workaround
==========
Disable CID-encoded Type 1 fonts by removing the "type1" module and
replacing it with the "freetype" module in xorg.conf.
Resolution
==========
All libXfont users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=x11-libs/libXfont-1.2.1"
All monolithic X.org users are advised to migrate to modular X.org.
References
==========
[ 1 ] CVE-2006-3739
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-3739
[ 2 ] CVE-2006-3740
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2006-3740
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200609-07.xml
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security (at) gentoo (dot) org [email concealed] or alternatively, you may file a bug at
http://bugs.gentoo.org.
License
=======
Copyright 2006 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iD8DBQBFCDsezKC5hMHO6rkRAi+CAJ9sYQjkmHWGsCliHCe3g+zt/ciA3QCeJS0O
Cl8k5uP9SFbSCIavzhjMirI=
=8OTr
-----END PGP SIGNATURE-----
[ reply ]