https://bugzilla.redhat.com/show_bug.cgi?id=1203715
Bug ID: 1203715 Summary: CVE-2015-1802 libXfont: missing range check in bdfReadProperties Product: Security Response Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: mprpic@redhat.com CC: btissoir@redhat.com, fonts-bugs@lists.fedoraproject.org, sandmann@redhat.com
The bdf parser reads a count for the number of properties defined in a font from the font file, and allocates arrays with entries for each property based on that count. It never checked to see if that count was negative, or large enough to overflow when multiplied by the size of the structures being allocated, and could thus allocate the wrong buffer size, leading to out of bounds writes.
A local user could exploit this issue to potentially execute arbitrary code with the privileges of the X.Org server.
Upstream advisory:
http://seclists.org/oss-sec/2015/q1/865
Upstream patch:
http://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=2deda9906480f9c8ae0...
https://bugzilla.redhat.com/show_bug.cgi?id=1203715
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1203720
--- Comment #1 from Martin Prpic mprpic@redhat.com ---
Created libXfont tracking bugs for this issue:
Affects: fedora-all [bug 1203720]
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1203720 [Bug 1203720] CVE-2015-1802 libXfont: missing range check in bdfReadProperties [fedora-all]
https://bugzilla.redhat.com/show_bug.cgi?id=1203715
Martin Prpic mprpic@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1203722
https://bugzilla.redhat.com/show_bug.cgi?id=1203715 Bug 1203715 depends on bug 1203720, which changed state.
Bug 1203720 Summary: CVE-2015-1804 CVE-2015-1802 CVE-2015-1803 libXfont: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1203720
What |Removed |Added ---------------------------------------------------------------------------- Status|ON_QA |CLOSED Resolution|--- |ERRATA
https://bugzilla.redhat.com/show_bug.cgi?id=1203715
--- Comment #2 from Fedora Update System updates@fedoraproject.org --- libXfont-1.5.1-1.fc21 has been pushed to the Fedora 21 stable repository. If problems still persist, please make note of it in this bug report.
https://bugzilla.redhat.com/show_bug.cgi?id=1203715
Stefan Cornelius scorneli@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |high Severity|medium |high
https://bugzilla.redhat.com/show_bug.cgi?id=1203715
Stefan Cornelius scorneli@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=moderate,public=2015 |impact=important,public=201 |0317,reported=20150318,sour |50317,reported=20150318,sou |ce=internet,cvss2=4.4/AV:L/ |rce=internet,cvss2=4.4/AV:L |AC:M/Au:N/C:P/I:P/A:P,rhel- |/AC:M/Au:N/C:P/I:P/A:P,rhel |5/libXfont=affected,rhel-6/ |-5/libXfont=affected,rhel-6 |libXfont=affected,rhel-7/li |/libXfont=affected,rhel-7/l |bXfont=affected,fedora-all/ |ibXfont=affected,fedora-all |libXfont=affected |/libXfont=affected
--- Doc Text *updated* --- An integer overflow flaw was found in the way libXfont processed certain Glyph Bitmap Distribution Format (BDF) fonts. A malicious, local user could exploit this issue to crash the X.Org server or potentially execute arbitrary code with the privileges of the X.Org server.
https://bugzilla.redhat.com/show_bug.cgi?id=1203715
Stefan Cornelius scorneli@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |50317,reported=20150318,sou |50317,reported=20150318,sou |rce=internet,cvss2=4.4/AV:L |rce=internet,cvss2=4.4/AV:L |/AC:M/Au:N/C:P/I:P/A:P,rhel |/AC:M/Au:N/C:P/I:P/A:P,rhel |-5/libXfont=affected,rhel-6 |-5/libXfont=affected,rhel-6 |/libXfont=affected,rhel-7/l |/libXfont=affected,rhel-7/l |ibXfont=affected,fedora-all |ibXfont=affected,fedora-all |/libXfont=affected |/libXfont=affected,cwe=CWE- | |119->CWE-190->CWE-122->CWE- | |131->CWE-190
https://bugzilla.redhat.com/show_bug.cgi?id=1203715
--- Doc Text *updated* by Martin Prpic mprpic@redhat.com --- An integer overflow flaw was found in the way libXfont processed certain Glyph Bitmap Distribution Format (BDF) fonts. A malicious, local user could use this flaw to crash the X.Org server or, potentially, execute arbitrary code with the privileges of the X.Org server.
https://bugzilla.redhat.com/show_bug.cgi?id=1203715
Stefan Cornelius scorneli@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1258892 Depends On| |1258893 Depends On| |1258894 Depends On| |1258895
https://bugzilla.redhat.com/show_bug.cgi?id=1203715
--- Comment #4 from errata-xmlrpc errata-xmlrpc@redhat.com --- This issue has been addressed in the following products:
Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 6
Via RHSA-2015:1708 https://rhn.redhat.com/errata/RHSA-2015-1708.html
https://bugzilla.redhat.com/show_bug.cgi?id=1203715
ddu@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- CC| |ddu@redhat.com
--- Comment #5 from ddu@redhat.com --- Hi guys,
Does this problem CVE affect libXfont shipped with RHEL5?
Best regards, Dapeng
https://bugzilla.redhat.com/show_bug.cgi?id=1203715
Stefan Cornelius scorneli@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Whiteboard|impact=important,public=201 |impact=important,public=201 |50317,reported=20150318,sou |50317,reported=20150318,sou |rce=internet,cvss2=4.4/AV:L |rce=internet,cvss2=6.9/AV:L |/AC:M/Au:N/C:P/I:P/A:P,rhel |/AC:M/Au:N/C:C/I:C/A:C,rhel |-5/libXfont=affected,rhel-6 |-5/libXfont=affected,rhel-6 |/libXfont=affected,rhel-7/l |/libXfont=affected,rhel-7/l |ibXfont=affected,fedora-all |ibXfont=affected,fedora-all |/libXfont=affected,cwe=CWE- |/libXfont=affected,cwe=CWE- |119->CWE-190->CWE-122->CWE- |119->CWE-190->CWE-122->CWE- |131->CWE-190 |131->CWE-190
fonts-bugs@lists.fedoraproject.org
-
Red Hat Bugzilla