CVE-2007-1351
Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.59%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.
- CVSS 2.0
- 8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
- EPSS
- 5.59% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-189
- Affected
- ubuntu/ubuntu linux · x.org/libxfont · xfree86 project/x11r6 · rpath/rpath linux · redhat/enterprise linux · redhat/enterprise linux desktop · redhat/linux advanced workstation · openbsd/openbsd · mandrakesoft/mandrake multi network firewall
- Source
- secalert@redhat.com
References
- http://issues.foresightlinux.org/browse/FL-223
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=501Patch
- http://lists.apple.com/archives/Security-announce/2007/Nov/msg00003.html
- http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
- http://lists.freedesktop.org/archives/xorg-announce/2007-April/000286.html
- http://rhn.redhat.com/errata/RHSA-2007-0125.html
- http://secunia.com/advisories/24741Vendor Advisory
- http://secunia.com/advisories/24745
- http://secunia.com/advisories/24756
- http://secunia.com/advisories/24758
- http://secunia.com/advisories/24765
- http://secunia.com/advisories/24768
- http://secunia.com/advisories/24770Vendor Advisory
- http://secunia.com/advisories/24771
- http://secunia.com/advisories/24772
- http://secunia.com/advisories/24776
- http://secunia.com/advisories/24791
- http://secunia.com/advisories/24885
- http://secunia.com/advisories/24889
- http://secunia.com/advisories/24921
- http://secunia.com/advisories/24996
- http://secunia.com/advisories/25004
- http://secunia.com/advisories/25006
- http://secunia.com/advisories/25096
- http://secunia.com/advisories/25195
- http://secunia.com/advisories/25216
- http://secunia.com/advisories/25305
- http://secunia.com/advisories/25495
- http://secunia.com/advisories/28333
- http://secunia.com/advisories/30161
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.