CVE-2007-1352 Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which resu...
LowCVSS 3.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mandrakesoft mandrake multi network firewall | = 2.0 | No fix listed |
| x.org libxfont | = 1.2.2 | No fix listed |
| redhat enterprise linux | = 2.1 | No fix listed |
| redhat enterprise linux | = 3.0 | No fix listed |
| redhat enterprise linux | = 4.0 | No fix listed |
| redhat enterprise linux desktop | = 3.0 | No fix listed |
| redhat enterprise linux desktop | = 4.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat fedora core | = core_1.0 | No fix listed |
| redhat linux | = 9.0 | No fix listed |
| redhat linux advanced workstation | = 2.1 | No fix listed |
| slackware linux | = 9.0 | No fix listed |
| slackware linux | = 9.1 | No fix listed |
| slackware linux | = current | No fix listed |
| turbolinux desktop | = 10.0 | No fix listed |
| ubuntu linux | = 4.1 | No fix listed |
| ubuntu linux | = 5.10 | No fix listed |
| ubuntu linux | = 6.06_lts | No fix listed |
| ubuntu linux | = 6.10 | No fix listed |
| rpath linux | = 1 | No fix listed |
| OpenBSD | = 3.9 | No fix listed |
| OpenBSD | = 4.0 | No fix listed |
| debian/libxfont(Debian:12) | < 1:1.2.2-2 | 1:1.2.2-2 |
| debian/libxfont(Debian:13) | < 1:1.2.2-2 | 1:1.2.2-2 |
| debian/libxfont(Debian:14) | < 1:1.2.2-2 | 1:1.2.2-2 |
References
- issues.foresightlinux.org
- 20070403 Multiple Vendor X Server fonts.dir File Parsing Integer Overflow Vulnerability third-party-advisory
- APPLE-SA-2007-11-14 vendor-advisory
- APPLE-SA-2009-02-12 vendor-advisory
- [xorg-announce] 20070403 various integer overflow vulnerabilites in xserver, libX11 and libXfont mailing-list
- RHSA-2007:0125 vendor-advisory
- 24741 third-party-advisory vendor-advisory
- 24745 third-party-advisory
- 24756 patch third-party-advisory vendor-advisory
- 24758 third-party-advisory
- 24765 third-party-advisory
- 24770 patch third-party-advisory vendor-advisory
- 24771 third-party-advisory
- 24772 third-party-advisory
- 24791 third-party-advisory
- 25004 third-party-advisory
- 25006 third-party-advisory
- 25195 third-party-advisory
- 25216 third-party-advisory
- 25305 third-party-advisory
- 33937 third-party-advisory
- GLSA-200705-10 vendor-advisory
- 102886 vendor-advisory
- support.apple.com
- support.avaya.com
- DSA-1294 vendor-advisory
- MDKSA-2007:079 vendor-advisory
- MDKSA-2007:080 vendor-advisory
- SUSE-SA:2007:027 vendor-advisory
- [3.9] 021: SECURITY FIX: April 4, 2007 vendor-advisory
- [4.0] 011: SECURITY FIX: April 4, 2007 vendor-advisory
- RHSA-2007:0126 vendor-advisory
- RHSA-2007:0132 vendor-advisory
- 20070404 rPSA-2007-0065-1 freetype xorg-x11 xorg-x11-fonts xorg-x11-tools xorg-x11-xfs mailing-list
- 20070405 FLEA-2007-0009-1: xorg-x11 freetype mailing-list
- 23283 vdb-entry
- 23300 vdb-entry
- 1017857 vdb-entry
- USN-448-1 vendor-advisory
- ADV-2007-1217 vdb-entry
- ADV-2007-1548 vdb-entry
- xorg-fontsdir-bo(33419) vdb-entry
- issues.rpath.com
- oval:org.mitre.oval:def:10523 signature vdb-entry
- oval:org.mitre.oval:def:13243 signature vdb-entry
- Debian Security Tracker CVE-2007-1352 vendor-advisory