CVE-2011-2895 The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, Free...
HighCVSS 9.3
EPSS 8.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libxfont(Debian:12) | < 1:1.4.4-1 | 1:1.4.4-1 |
| debian/libxfont(Debian:13) | < 1:1.4.4-1 | 1:1.4.4-1 |
| debian/libxfont(Debian:14) | < 1:1.4.4-1 | 1:1.4.4-1 |
| freetype | = 2.1.9 | No fix listed |
| x libxfont | <= 1.4.3 | No fix listed |
| x libxfont | = 1.2.0 | No fix listed |
| x libxfont | = 1.2.1 | No fix listed |
| x libxfont | = 1.2.2 | No fix listed |
| x libxfont | = 1.2.3 | No fix listed |
| x libxfont | = 1.2.4 | No fix listed |
| x libxfont | = 1.2.5 | No fix listed |
| x libxfont | = 1.2.6 | No fix listed |
| x libxfont | = 1.2.7 | No fix listed |
| x libxfont | = 1.2.8 | No fix listed |
| x libxfont | = 1.2.9 | No fix listed |
| x libxfont | = 1.3.0 | No fix listed |
| x libxfont | = 1.3.1 | No fix listed |
| x libxfont | = 1.3.2 | No fix listed |
| x libxfont | = 1.3.3 | No fix listed |
| x libxfont | = 1.3.4 | No fix listed |
| x libxfont | = 1.4.0 | No fix listed |
| x libxfont | = 1.4.1 | No fix listed |
| x libxfont | = 1.4.2 | No fix listed |
| freebsd | All versions | No fix listed |
| netbsd | All versions | No fix listed |
Show 18 more
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenBSD | <= 3.7 | No fix listed |
| OpenBSD | = 2.0 | No fix listed |
| OpenBSD | = 2.1 | No fix listed |
| OpenBSD | = 2.2 | No fix listed |
| OpenBSD | = 2.3 | No fix listed |
| OpenBSD | = 2.4 | No fix listed |
| OpenBSD | = 2.5 | No fix listed |
| OpenBSD | = 2.6 | No fix listed |
| OpenBSD | = 2.7 | No fix listed |
| OpenBSD | = 2.8 | No fix listed |
| OpenBSD | = 2.9 | No fix listed |
| OpenBSD | = 3.0 | No fix listed |
| OpenBSD | = 3.1 | No fix listed |
| OpenBSD | = 3.2 | No fix listed |
| OpenBSD | = 3.3 | No fix listed |
| OpenBSD | = 3.4 | No fix listed |
| OpenBSD | = 3.5 | No fix listed |
| OpenBSD | = 3.6 | No fix listed |
References
- Debian Security Tracker CVE-2011-2895 vendor-advisory
- cgit.freedesktop.org patch
- NetBSD-SA2011-007 vendor-advisory
- APPLE-SA-2012-02-01-1 vendor-advisory
- APPLE-SA-2012-05-09-1 vendor-advisory
- APPLE-SA-2015-12-08-1 vendor-advisory
- APPLE-SA-2015-12-08-2 vendor-advisory
- APPLE-SA-2015-12-08-4 vendor-advisory
- APPLE-SA-2015-12-08-3 vendor-advisory
- [xorg-announce] 20110810 X.Org security advisory: libXfont LZW decompression heap corruption mailing-list patch
- [xorg-announce] 20110810 [ANNOUNCE] libXfont 1.4.4 mailing-list patch
- SUSE-SU-2011:1035 vendor-advisory
- openSUSE-SU-2011:1299 vendor-advisory
- 45544 third-party-advisory vendor-advisory
- 45568 third-party-advisory vendor-advisory
- 45599 third-party-advisory vendor-advisory
- 45986 third-party-advisory
- 46127 third-party-advisory
- 48951 third-party-advisory
- 1025920 vdb-entry
- support.apple.com
- support.apple.com
- DSA-2293 vendor-advisory
- MDVSA-2011:153 vendor-advisory
- www.openbsd.org
- [oss-security] 20110810 LZW decompression issues mailing-list
- RHSA-2011:1154 vendor-advisory
- RHSA-2011:1155 vendor-advisory
- RHSA-2011:1161 vendor-advisory
- RHSA-2011:1834 vendor-advisory
- 49124 vdb-entry
- USN-1191-1 vendor-advisory
- bugzilla.redhat.com patch
- bugzilla.redhat.com
- xorg-lzw-bo(69141) vdb-entry
- support.apple.com
- support.apple.com
- support.apple.com
- support.apple.com